CVE-2026-113667: 
JavaScript vulnerability analysis and mitigation

CVE-2026-113667 is a parameter injection vulnerability in ApostropheCMS's CAPTCHA integration add-ons, where user-supplied CAPTCHA response tokens are interpolated unencoded into server-side verification requests. It affects @apostrophecms/form versions prior to 1.5.5, @apostrophecms/login-recaptcha prior to 1.2.1, @apostrophecms/login-hcaptcha prior to 1.3.0, and the core apostrophecms/apostrophe package prior to 4.33.0. The vulnerability was published on October 2, 2026, and added to the GitHub Advisory Database on October 20, 2026. It carries a CVSS v4 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-116 (Improper Encoding or Escaping of Output): user-supplied CAPTCHA response tokens are directly interpolated into template strings used to construct outbound HTTP verification requests to reCAPTCHA or hCaptcha, without URL encoding. Specifically, packages/form/lib/recaptcha.js:39 constructs the verify URL as `https://www.google.com/recaptcha/api/siteverify?secret=${recaptchaSecret}&response=${input.recaptcha}`, and analogous patterns exist in packages/login-recaptcha/index.js:44 and packages/login-hcaptcha/index.js:47. An attacker with low-privilege access can craft a token such as attacker_token&secret=INJECTED_SECRET&something=1, which results in the injected parameters being appended to the verification URL, overriding or duplicating query parameters in the outbound request. The fix requires building verification requests using URLSearchParams and validating tokens against a strict allowlist pattern (^[A-Za-z0-9._-]{1,2048}$) before use (GitHub Advisory, Patch Commit).

Successful exploitation can disrupt CAPTCHA-gated login and form submission flows by forcing verification failures, effectively creating a denial-of-service condition against the CAPTCHA gate and enabling automated bypass probing of those endpoints. While no confirmed CAPTCHA bypass or secret exfiltration has been established, the vulnerability allows an attacker to smuggle extra key-value pairs (including a duplicate secret parameter) into the outbound verification call, potentially interfering with the integrity of the verification process. The impact is limited to the vulnerable system itself, with no demonstrated lateral movement or downstream system compromise (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (an account or the ability to submit a form/login request) and no user interaction, making automated probing feasible but not yet observed.

1. Identify target: Locate an ApostropheCMS site using the vulnerable @apostrophecms/form, @apostrophecms/login-recaptcha, or @apostrophecms/login-hcaptcha add-ons (versions below the patched releases).
2. Craft malicious CAPTCHA token: Construct a token containing injected query parameters, e.g., attacker_token&secret=INJECTED_SECRET&something=1.
3. Submit crafted token: Submit the malicious token as the CAPTCHA response field in a login or form submission request to the ApostropheCMS endpoint.
4. Observe verification disruption: The server interpolates the unencoded token directly into the verification URL, resulting in a request like https://www.google.com/recaptcha/api/siteverify?secret=<real_secret>&response=attacker_token&secret=INJECTED_SECRET&something=1, which causes the CAPTCHA verification to fail or behave unexpectedly.
5. Probe for bypass: Repeat with varied payloads to probe whether the injected parameters can cause the verification provider to return a success response, potentially bypassing the CAPTCHA gate on login or form submission endpoints (GitHub Advisory).

• Network: Unusual or repeated CAPTCHA verification failures logged from a single IP or user agent; outbound requests to https://www.google.com/recaptcha/api/siteverify or https://hcaptcha.com/siteverify containing duplicate or unexpected query parameters (e.g., multiple secret= or response= values).
• Logs: Server-side logs showing CAPTCHA verification errors or unexpected parameter structures in verification requests; repeated failed form submissions or login attempts with malformed CAPTCHA tokens.
• Application: Anomalous patterns of CAPTCHA-gated form submissions or login attempts that consistently fail verification, potentially indicating automated probing activity.

Update the affected ApostropheCMS add-ons to their patched versions: @apostrophecms/form 1.5.5, @apostrophecms/login-recaptcha 1.2.1, and @apostrophecms/login-hcaptcha 1.3.0. The core apostrophecms/apostrophe package should also be updated to 4.33.0 or later. The fix encodes CAPTCHA verification parameters using URLSearchParams and rejects tokens that are not strings or do not match the pattern ^[A-Za-z0-9._-]{1,2048}$. As an interim measure, implement server-side monitoring for anomalous CAPTCHA verification failures and consider rate-limiting CAPTCHA-gated endpoints (GitHub Advisory, Form Release).

The vulnerability was reported by security researcher Anisetti Chaitanya Eshwar Prasad and acknowledged by the ApostropheCMS maintainer (boutell) in the official GitHub security advisory. The fix was included as part of a broader batch of security advisories merged in the same release cycle, addressing multiple vulnerabilities across the ApostropheCMS ecosystem (Patch Commit, GitHub Advisory).