HTML Injection via Unescaped URLs in FreeScout linkify() Function

Executive Summary

CVE-2026-40565 is a stored Cross-Site Scripting (XSS) and CSS injection vulnerability in FreeScout versions prior to 1.8.213. It occurs in the linkify() function, which converts plain-text URLs in email bodies into HTML anchor tags. The function fails to properly escape double-quote characters (") within URLs, allowing these characters to break out of the href attribute context and inject arbitrary HTML attributes.

Specifically, the email body is first sanitized by HTMLPurifier, which preserves literal double-quote characters. Then, linkify() wraps URLs containing these quotes inside unescaped href attributes, enabling injection of malicious HTML such as CSS styles or JavaScript event handlers.

This vulnerability allows an attacker to craft URLs that, when viewed by a helpdesk agent, inject malicious CSS or JavaScript into the interface, leading to UI redressing or session hijacking.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting email bodies processed by FreeScout versions prior to 1.8.213 for unescaped double-quote characters within URLs that are converted into HTML anchor tags. Specifically, look for anchor tags where the href attribute is broken out by unescaped quotes, allowing injection of arbitrary HTML attributes such as style.

A practical detection method is to search the email content or logs for suspicious anchor tags containing double-quote characters inside URLs that lead to injected attributes. For example, look for patterns like: <a href="http://evil.com/"style="..."> which indicate the vulnerability.

Suggested commands to detect this issue include using grep or similar tools to search for unescaped double quotes in href attributes within stored email bodies or logs:

• grep -rP '<a href="[^"]*"[^"]*>' /path/to/freescout/data/emails
• grep -r 'href="http' /path/to/freescout/data/emails | grep '"style='

Additionally, reviewing the FreeScout version in use can help determine if the system is vulnerable. Versions prior to 1.8.213 are affected.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote, unauthenticated attackers to inject malicious CSS and potentially JavaScript into the FreeScout helpdesk agent's interface.

• UI redressing attacks that overlay or manipulate the agent's viewport.
• Session hijacking through injected JavaScript if Content Security Policy (CSP) is not strict.
• Compromise of agent interactions by injecting malicious attributes like onclick handlers.

The attack requires an attacker to send a specially crafted email containing malicious URLs to the helpdesk mailbox, which is then viewed by an agent, triggering the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability CVE-2026-40565 is a stored cross-site scripting (XSS) and CSS injection issue that allows unauthenticated attackers to inject malicious HTML attributes into email bodies viewed by agents. This can lead to UI redressing attacks and potential session hijacking if Content Security Policy (CSP) protections are bypassed.

While the CVE description and resources do not explicitly mention compliance with standards such as GDPR or HIPAA, the presence of a stored XSS vulnerability in a help desk system handling potentially sensitive email content could pose risks to confidentiality and integrity of data. Such risks may impact compliance with regulations that require protection of personal and sensitive information against unauthorized access or manipulation.

Therefore, organizations using vulnerable versions of FreeScout prior to 1.8.213 might face challenges in maintaining compliance with security requirements of common standards and regulations due to the potential for data exposure or manipulation via this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade FreeScout to version 1.8.213 or later, where the vulnerability is fixed by properly escaping URLs and email addresses in the linkify() function.

If upgrading is not immediately possible, consider applying the patch that escapes href attribute values and link text using PHP's htmlspecialchars() function with ENT_QUOTES and UTF-8 encoding to prevent injection.

Additionally, enforce strict Content Security Policy (CSP) headers to limit the impact of injected scripts or styles.

Monitor incoming emails for suspicious URLs containing double quotes or unusual attributes and consider filtering or sanitizing such inputs before processing.

Useful 0 Not Useful 0