Is CVE-2026-53592 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-53592 being exploited in the wild.

How severe is CVE-2026-53592?

Medium severity, with a CVSS score of 4.6, published 20 July 2026.

Which products and versions are affected?

freescout-help-desk FreeScout < 1.8.223.

Is there a fix for CVE-2026-53592?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-53592 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-53592?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53592: FreeScout Prototype Pollution in getQueryParam function

Q: Is there a fix for CVE-2026-53592?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-53592 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-53592?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-53592 · Severity: medium · CVSS 4.6 · Published 2026-07-20

FreeScout is an open-source help desk and shared inbox platform. A security flaw in its web interface allows an attacker to manipulate the underlying JavaScript environment by sending a specially crafted link to a logged-in user. This could potentially lead to unauthorized changes in how the application behaves, such as redirecting users to malicious sites or stealing sensitive information if combined with other vulnerabilities.

Quick answers

Is CVE-2026-53592 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-53592 being exploited in the wild.
How severe is CVE-2026-53592?: Medium severity, with a CVSS score of 4.6, published 20 July 2026.
Which products and versions are affected?: freescout-help-desk FreeScout < 1.8.223.
Is there a fix for CVE-2026-53592?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-53592 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-53592?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Prototype Pollution vulnerability exists in the `getQueryParam` function within `/public/js/main.js` of FreeScout. While a previous fix (v1.8.139) attempted to block the `__proto__` key, it only checked if the top-level query parameter started with that string. An attacker can bypass this by using nested bracket notation, such as `b[__proto__][polluted]=value`, which the regex fails to catch. This allows an authenticated attacker to inject properties into the global `Object.prototype` via a crafted URL. If the application later uses these polluted properties in a sensitive context, it could lead to DOM-based XSS or other client-side attacks. The issue is fully resolved in version 1.8.223.

Affected products

freescout-help-desk FreeScout < 1.8.223

Timeline

2026-06-10: advisory: GitHub Security Advisory published
2026-07-20: disclosed: CVE published to NVD

References

https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-w5fc-8pp3-f755

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.