CVE-2026-53592
Received Received - Intake

Prototype Pollution in FreeScout via Nested Query Parameters

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/main.js` and was addressed in version 1.8.139 by blocking URL query keys matching the pattern `__proto__`. However, this mitigation is incomplete: it only filters top-level `__proto__` keys and fails to sanitize nested forms such as `b[__proto__][polluted]=PWNED`. As a result, an attacker-controlled URL query string can still write into `Object.prototype` on any page that loads `main.js`. Version 1.8.223 contains a updated fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-53592
EUVD
EUVD-2026-46082

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
freescout freescout to 1.8.223 (exc)
freescout freescout From 1.8.223 (inc)
freescout freescout to 1.8.139 (inc)
freescout freescout to 1.8.223 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Prototype Pollution vulnerability in FreeScout, a help desk application. It exists in the getQueryParam function in main.js and allows attackers to manipulate Object.prototype via crafted URLs. The initial fix in version 1.8.139 was incomplete, only blocking top-level __proto__ keys but missing nested forms like b[__proto__][polluted]=PWNED.

Detection Guidance

Check if your FreeScout version is prior to 1.8.223 by running: grep -r "getQueryParam" /path/to/freescout/public/js/main.js. If the function exists and lacks proper sanitization for nested __proto__ keys, the system is vulnerable.

Impact Analysis

An attacker could exploit this to set properties on Object.prototype, potentially enabling further attacks like DOM-based XSS, Open Redirection, or Cookie Manipulation. This could lead to unauthorized data access, session hijacking, or other malicious activities depending on the application's context.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling attacks like DOM-based XSS or cookie manipulation through prototype pollution. Such attacks may lead to unauthorized data access, modification, or exfiltration, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade FreeScout to version 1.8.223 or later immediately. If upgrading is not possible, apply a patch to block nested __proto__ patterns in query parameters. Review and sanitize all user-controlled input in JavaScript functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53592. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart