Executive brief
Roskus Prospero Flow CRM, a customer relationship management platform, is vulnerable to a security flaw where malicious code can be injected into lead names. An authorized user with permission to create or update leads can enter specially crafted text that executes arbitrary commands in the browser of other users viewing the lead index. This could allow an attacker to perform unauthorized actions on behalf of other users or manipulate how information is displayed within the CRM.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the lead index view (resources/views/lead/index.blade.php) of Roskus Prospero Flow CRM. The vulnerability stems from improper neutralization of the lead name field, which is rendered using Blade's unescaped output directive ({!! !!}) in save confirmation messages and interpolated into a JavaScript string literal within an onclick attribute. An authenticated attacker with 'create lead' or 'update lead' permissions can inject malicious HTML/JavaScript. While session cookies are protected by the HttpOnly attribute, an attacker can still execute arbitrary script in the context of the application origin. The issue was addressed in version 5.3.7 (commit 8b2633dd) and is included in the v5.5.3 tagged release.
Affected products
- Roskus Prospero Flow CRM before 5.3.7
Timeline
- 2026-06-23: patched: Fix committed in 8b2633dd
- 2026-07-31: disclosed: CVE published by Secur0 CNA