Description
Summary Form and login CAPTCHA verification interpolate the user-supplied widget token unencoded into the server-side verification URL/body, allowing a crafted token to inject query parameters into the reCAPTCHA/hCaptcha verify request.
Details
packages/form/lib/recaptcha.js:39—recaptchaUri = 'https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}'packages/login-recaptcha/index.js:44— same pattern for login- `packages/login-hcaptcha/index.
Recommendation
Update the @apostrophecms/form package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.5.5
- Patched version(s): 1.5.5
References
Could your website be exposed too?
SmartScanner can check your website for ApostropheCMS: CAPTCHA response token not URL-encoded and gives you actionable findings to investigate.
Start a free scanRelated Issues
- ApostropheCMS: CAPTCHA response token not URL-encoded - @apostrophecms/login-recaptcha - CVE-2026-113667
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
- ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS - CVE-2026-113656
You might also like:
See something that needs correcting? Let us knowUpdated October 20, 2026