CVE-2026-34206 in captcha-protect

Sumário (Inglês)

Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet. Prior to version 1.12.2, a reflected cross-site scripting (XSS) vulnerability exists in github.com/libops/captcha-protect. The challenge page accepted a client-supplied destination value and rendered it into HTML using Go's text/template. Because text/template does not perform contextual HTML escaping, an attacker could supply a crafted destination value that breaks out of the hidden input attribute and injects arbitrary script into the challenge page. This issue has been patched in version 1.12.2.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Responsável

GitHub_M

Reservar

26/03/2026

Divulgação

31/03/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354501	libops captcha-protect Destination Script de Site Cruzado	79	Não definido	Correção oficial	CVE-2026-34206

Fontes

• MITRE
• NVD
• CVE Details