CVE-2026-53592

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/main.js` and was addressed in version 1.8.139 by blocking URL query keys matching the pattern `__proto__`. However, this mitigation is incomplete: it only filters top-level `__proto__` keys and fails to sanitize nested forms such as `b[__proto__][polluted]=PWNED`. As a result, an attacker-controlled URL query string can still write into `Object.prototype` on any page that loads `main.js`. Version 1.8.223 contains a updated fix.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w5fc-8pp3-f755
https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w5fc-8pp3-f755

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) FreeScout es una mesa de ayuda gratuita y bandeja de entrada compartida construida con el framework Laravel de PHP. Una condición de Contaminación de Prototipos en la función ’getQueryParam’ de ’/public/js/main.js’ fue abordada en la versión 1.8.139 mediante el bloqueo de claves de consulta URL que coinciden con el patrón ’__proto__’. Sin embargo, esta mitigación es incompleta: solo filtra claves ’__proto__’ de nivel superior y no logra sanear formas anidadas como ’b[__proto__][polluted]=PWNED’. Como resultado, una cadena de consulta URL controlada por un atacante todavía puede escribir en ’Object.prototype’ en cualquier página que cargue ’main.js’. La versión 1.8.223 contiene una corrección actualizada.

Information

Published : 2026-07-20 20:16

Updated : 2026-10-24 20:10

NVD link : CVE-2026-53592

Mitre link : CVE-2026-53592

CVE.ORG link : CVE-2026-53592

JSON object : View

Products Affected

No product.

CWE

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-53592", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53592", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T14:42:11.918943Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "freescout-help-desk", "product": "freescout", "versions": [{"status": "affected", "version": "< 1.8.223"}]}]}], "published": "2026-07-20T20:16:44.747", "references": [{"url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w5fc-8pp3-f755", "source": "security-advisories@github.com"}, {"url": "https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w5fc-8pp3-f755", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the `getQueryParam` function `/public/js/main.js` and was addressed in version 1.8.139 by blocking URL query keys matching the pattern `__proto__`. However, this mitigation is incomplete: it only filters top-level `__proto__` keys and fails to sanitize nested forms such as `b[__proto__][polluted]=PWNED`. As a result, an attacker-controlled URL query string can still write into `Object.prototype` on any page that loads `main.js`. Version 1.8.223 contains a updated fix."}, {"lang": "es", "value": "FreeScout es una mesa de ayuda gratuita y bandeja de entrada compartida construida con el framework Laravel de PHP. Una condici\u00f3n de Contaminaci\u00f3n de Prototipos en la funci\u00f3n \u2019getQueryParam\u2019 de \u2019/public/js/main.js\u2019 fue abordada en la versi\u00f3n 1.8.139 mediante el bloqueo de claves de consulta URL que coinciden con el patr\u00f3n \u2019__proto__\u2019. Sin embargo, esta mitigaci\u00f3n es incompleta: solo filtra claves \u2019__proto__\u2019 de nivel superior y no logra sanear formas anidadas como \u2019b[__proto__][polluted]=PWNED\u2019. Como resultado, una cadena de consulta URL controlada por un atacante todav\u00eda puede escribir en \u2019Object.prototype\u2019 en cualquier p\u00e1gina que cargue \u2019main.js\u2019. La versi\u00f3n 1.8.223 contiene una correcci\u00f3n actualizada."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}