The vulnerability in libops captcha-protect (before version 1.12.2) is due to improper neutralization of input during web page generation (CWE-79). Specifically, the middleware uses Go's text/template to render a client-supplied destination value into the HTML of the challenge page. Since text/template does not perform contextual HTML escaping, an attacker can craft a destination value that breaks out of the hidden input attribute and injects malicious script, resulting in reflected XSS. This can lead to limited confidentiality and integrity impacts. The vulnerability is addressed by updating to version 1.12.2.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser when they access the challenge page, potentially leading to limited confidentiality and integrity impacts. There is no impact on availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change.

Upgrade libops captcha-protect to version 1.12.2 or later, where this reflected XSS vulnerability is patched. No other mitigations are specified or required once the update is applied.