CVE-2026-34206

Katalog CVE

CVSS 6.1 · Medium EPSS 0,33%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada libops captcha protect. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet. Prior to version 1.12.2, a reflected cross-site scripting (XSS) vulnerability exists in github.com/libops/captcha-protect. The challenge page accepted a client-supplied destination value and rendered it into HTML using Go's text/template. Because text/template does not perform contextual HTML escaping, an attacker could supply a crafted destination value that breaks out of the hidden input attribute and injects arbitrary script into the challenge page. This issue has been patched in version 1.12.2.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/libops/captcha-protect/security/advisories/GHSA-ph62-4j5g-2q4r mitigasi · patch · advisory vendor
• https://github.com/libops/captcha-protect/commit/eef6211ecd1147273be484d913b81c68c0bd8d3f patch
• https://github.com/libops/captcha-protect/releases/tag/v1.12.2 product · release notes