CVE-2026-59232: Prospero Flow CRM XSS Vulnerability

CVE-2026-59232 Overview

CVE-2026-59232 is a stored Cross-Site Scripting (XSS) vulnerability in Roskus Prospero Flow CRM versions before 5.3.7. Authenticated users holding the create lead or update lead permission can inject arbitrary HTML markup into the lead name field. The application later renders that value in the lead index view through Blade's unescaped output directive and inside a JavaScript string literal within an onclick attribute. This produces reliable JavaScript execution in the application origin whenever another user views the affected lead. The flaw is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated attacker with lead management permissions can execute arbitrary JavaScript in victim browsers, enabling session hijacking, credential theft, and unauthorized CRM actions performed as the victim.

Affected Products

Roskus Prospero Flow CRM versions prior to 5.3.7
The vulnerable lead index Blade view rendering the name field
Fixed in Roskus Prospero Flow CRM release v5.5.3

Discovery Timeline

2026-07-31 - CVE-2026-59232 published to the National Vulnerability Database (NVD)
2026-07-31 - Last updated in the NVD database

Technical Details for CVE-2026-59232

Vulnerability Analysis

The vulnerability resides in the lead index view of Prospero Flow CRM, a Laravel-based customer relationship management application. The lead name field accepts arbitrary user input from any authenticated account holding the create lead or update lead permission. That value is persisted to the database without HTML sanitization and later rendered by a Blade template using the unescaped output directive {!! $variable !!} instead of the safe {{ $variable }} form.

The payload is additionally embedded inside a JavaScript string literal contained within an onclick handler. This dual injection point means both HTML markup and JavaScript-string-breaking characters produce script execution. Any user with access to the lead index view triggers the payload upon page load or interaction, resulting in stored XSS with a broad blast radius across CRM users.

Root Cause

The root cause is the combined use of Blade's unescaped output directive with unsanitized user-controlled input, compounded by rendering that same input inside an inline event handler. The application trusted authenticated users to submit safe HTML in the name field and did not apply strip_tags or encoding at either the input or output boundary.

Attack Vector

Exploitation requires an authenticated session with lead creation or update permissions. The attacker submits a crafted lead name containing HTML markup and JavaScript. When any subsequent user, including administrators, opens the lead index view, the payload executes in the application origin under that user's session.

php

// Security patch: SanitizesInput trait applied to form requests
// Source: https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c
<?php

declare(strict_types=1);

namespace App\Http\Requests\Concerns;

trait SanitizesInput
{
    /**
     * Exclude fields from sanitization
     * @return array<string>
     */
    protected function unsafeFields(): array
    {
        return [];
    }

    public function passedValidation(): void
    {
        $unsafe = $this->unsafeFields();
        $sanitized = [];

        foreach ($this->all() as $key => $value) {
            if (is_string($value) && ! in_array($key, $unsafe, true)) {
                $sanitized[$key] = strip_tags($value);
            }
        }

        if ($sanitized !== []) {
            $this->merge($sanitized);
        }
    }
}

The patch introduces a SanitizesInput trait that runs strip_tags on all string inputs after validation, applied to form requests such as TransactionSaveRequest.

Detection Methods for CVE-2026-59232

Indicators of Compromise

Lead records where the name field contains HTML tags such as <script>, <img, <svg, or event handler attributes like onerror, onload, onclick
Lead names containing quote characters or backslashes intended to break out of a JavaScript string literal
Outbound HTTP requests from user browsers to unfamiliar domains immediately after loading /leads or the lead index route
Unexpected session token or cookie exfiltration originating from authenticated CRM users

Detection Strategies

Query the leads table for name values matching regex patterns for HTML tags or JavaScript event handlers
Inspect Laravel application logs and web server access logs for POST requests to lead create or update endpoints with suspicious payloads in the name parameter
Monitor Content Security Policy (CSP) violation reports for inline script executions on lead index pages

Monitoring Recommendations

Alert on any lead record whose name field contains <, >, or backtick characters
Correlate authenticated user activity with anomalous JavaScript execution events reported via CSP endpoints
Track lead creation and update rates per user to identify accounts probing the field with iterative payloads

How to Mitigate CVE-2026-59232

Immediate Actions Required

Upgrade Roskus Prospero Flow CRM to version 5.3.7 or later; the v5.5.3 release contains the consolidated fix
Audit existing lead records for HTML markup in the name field and sanitize or remove offending entries
Review and restrict the create lead and update lead permissions to trusted user roles only
Rotate session tokens for any account that may have viewed a poisoned lead index

Patch Information

The fix is delivered in the security commit 8b2633dd, which introduces the SanitizesInput trait applying strip_tags to all form request string fields. The corresponding release is v5.5.3. Additional analysis is available in the Secur0 advisory.

Workarounds

Replace Blade unescaped output directives {!! $lead->name !!} with the safe form {{ $lead->name }} in the lead index view
Apply strip_tags() or htmlspecialchars() to the name field before persistence if immediate upgrade is not possible
Deploy a strict Content Security Policy that forbids inline scripts and inline event handlers on CRM pages
Temporarily restrict lead create and update permissions to a minimum set of trusted administrators

bash

# Verify installed version and upgrade via Git
git -C /var/www/prospero-flow-crm describe --tags
git -C /var/www/prospero-flow-crm fetch --tags
git -C /var/www/prospero-flow-crm checkout v5.5.3
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan config:cache

# Identify lead records containing HTML markup
php artisan tinker --execute="\App\Models\Lead::where('name','regexp','<[^>]+>')->get(['id','name']);"