CVE-2026-53592

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.223

Description A Prototype Pollution condition exists in the getQueryParam() function within the /public/js/main.js file. This occurs because the application fails to properly sanitize nested URL query keys, allowing an attacker to bypass initial filters that only blocked top-level proto keys. By using nested forms, an attacker can write arbitrary properties into Object.prototype on any page loading the affected script. Prototype Pollution is a vulnerability where an attacker can manipulate the prototype of a base object, potentially leading to unexpected behavior or security bypasses.

Recommendations Update to version 1.8.223.