CVE-2026-53592: FreeScout Prototype Pollution Vulnerability

CVE-2026-53592 Overview

CVE-2026-53592 is a Prototype Pollution vulnerability [CWE-1321] in FreeScout, a free help desk and shared inbox application built on PHP's Laravel framework. The flaw resides in the getQueryParam function within /public/js/main.js. An earlier fix in version 1.8.139 blocked top-level __proto__ query keys, but the sanitization does not cover nested payloads such as b[__proto__][polluted]=PWNED. Attackers can craft URL query strings that write into Object.prototype on any page loading main.js. Version 1.8.223 contains an updated fix.

Critical Impact
An attacker-controlled URL can pollute Object.prototype in a victim's browser session, potentially altering client-side application logic when the victim is enticed to click a crafted link.

Affected Products

FreeScout help desk application versions prior to 1.8.223
FreeScout deployments running the incomplete 1.8.139 mitigation
Any FreeScout page that loads /public/js/main.js

Discovery Timeline

2026-07-20 - CVE-2026-53592 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-53592

Vulnerability Analysis

The vulnerability is a client-side Prototype Pollution flaw in FreeScout's getQueryParam function inside /public/js/main.js. Prototype Pollution occurs when untrusted input is recursively assigned into a JavaScript object without validating property names. Attackers who can control property keys can reach Object.prototype, altering behavior for every object in the runtime.

FreeScout maintainers introduced a partial fix in version 1.8.139 by rejecting URL query keys matching the literal pattern __proto__. The filter operates only on top-level keys, so nested bracket notation bypasses it. A query string such as ?b[__proto__][polluted]=PWNED parses into a nested structure where __proto__ appears at the second level and evades the filter.

Exploitation requires user interaction because the payload is delivered through a crafted URL that the victim must load in an authenticated FreeScout context. The attack complexity is elevated by the need for social engineering and the reliance on downstream code that consumes polluted prototype properties.

Root Cause

The root cause is incomplete input sanitization in getQueryParam. The blocklist checks only the outermost key of parsed query parameters rather than recursively rejecting any occurrence of __proto__, constructor, or prototype at any depth.

Attack Vector

The attack vector is network-based via a crafted URL. An attacker sends a link containing a nested __proto__ payload to a FreeScout user. When the user visits the URL, main.js parses the query string and writes attacker-controlled values into Object.prototype. The polluted properties can then influence UI rendering, feature flags, or any client-side logic that reads properties from generic objects without hasOwnProperty checks.

// Example nested payload (conceptual)
https://freescout.example.com/conversation/1?b[__proto__][polluted]=PWNED

Detection Methods for CVE-2026-53592

Indicators of Compromise

URL query strings containing bracket-notation references to __proto__, constructor, or prototype such as b[__proto__][x]=y
Web server or reverse proxy access logs showing repeated requests to FreeScout paths with encoded %5B__proto__%5D sequences
Browser console errors or unexpected UI behavior on FreeScout pages after visiting external links

Detection Strategies

Inspect web server access logs for query parameters matching the regex (\[|%5B)(__proto__|constructor|prototype)(\]|%5D)
Deploy a Web Application Firewall (WAF) rule that blocks nested prototype-pollution key patterns in query strings and POST bodies
Review the FreeScout application version in use and flag any deployment below 1.8.223

Monitoring Recommendations

Forward FreeScout web access logs and WAF alerts into a centralized SIEM for correlation
Alert on inbound emails or chat messages containing FreeScout URLs with bracket-encoded query keys
Track outbound clicks from staff mailboxes to FreeScout URLs originating from untrusted senders

How to Mitigate CVE-2026-53592

Immediate Actions Required

Upgrade FreeScout to version 1.8.223 or later, which contains the updated fix that recursively rejects prototype-pollution keys
Audit any customizations or plugins that consume URL parameters through the patched getQueryParam function
Communicate to help desk staff to avoid clicking FreeScout links received from external, untrusted sources

Patch Information

The maintainers released version 1.8.223 with a corrected sanitizer that filters __proto__ at any nesting level. Refer to the FreeScout GitHub Security Advisory GHSA-w5fc-8pp3-f755 for full remediation details. The prior mitigation in 1.8.139 is insufficient and must be replaced.

Workarounds

Deploy a WAF or reverse proxy rule that strips or rejects query strings matching [__proto__], [constructor], or [prototype] patterns
Restrict FreeScout access to authenticated internal networks to reduce exposure to external attacker-controlled URLs
Instruct users to open FreeScout only from bookmarks or direct navigation until the upgrade is complete

bash

# Example NGINX rule to block nested prototype pollution query strings
if ($args ~* "(\[|%5B)(__proto__|constructor|prototype)(\]|%5D)") {
    return 400;
}