# CVE-2026-59232: Roskus Prospero Flow CRM stored XSS in lead name field

Source: https://junglewise.ai/threats/cve-2026-59232-roskus-prospero-flow-crm-stored-xss-in-lead-name-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-59232 · Severity: info · CVSS 5.3 · Published 2026-07-31

Roskus Prospero Flow CRM, a customer relationship management platform, is vulnerable to a security flaw where malicious code can be injected into lead names. An authorized user with permission to create or update leads can enter specially crafted text that executes arbitrary commands in the browser of other users viewing the lead index. This could allow an attacker to perform unauthorized actions on behalf of other users or manipulate how information is displayed within the CRM.

Technologies: [Roskus Prospero Flow CRM](https://junglewise.ai/threats/technologies/prospero-flow-crm). Vendors: [Roskus](https://junglewise.ai/threats/vendors/roskus).

## Quick answers

**Is CVE-2026-59232 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59232 being exploited in the wild.

**How severe is CVE-2026-59232?** Informational severity, with a CVSS score of 5.3, published 31 July 2026.

**Which products and versions are affected?** Roskus Prospero Flow CRM before 5.3.7.

**Is there a fix for CVE-2026-59232?** A patch was published on 2026-06-23: Fix committed in 8b2633dd Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59232 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59232?** Check whether you run Roskus Prospero Flow CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the lead index view (resources/views/lead/index.blade.php) of Roskus Prospero Flow CRM. The vulnerability stems from improper neutralization of the lead name field, which is rendered using Blade's unescaped output directive ({!! !!}) in save confirmation messages and interpolated into a JavaScript string literal within an onclick attribute. An authenticated attacker with 'create lead' or 'update lead' permissions can inject malicious HTML/JavaScript. While session cookies are protected by the HttpOnly attribute, an attacker can still execute arbitrary script in the context of the application origin. The issue was addressed in version 5.3.7 (commit 8b2633dd) and is included in the v5.5.3 tagged release.

## Affected products

- Roskus Prospero Flow CRM before 5.3.7

## Timeline

- 2026-06-23: patched: Fix committed in 8b2633dd
- 2026-07-31: disclosed: CVE published by Secur0 CNA

## References

- [https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c](https://github.com/Roskus/prospero-flow-crm/commit/8b2633ddb2178c2f79718efdfb906e051ba2f03c)
- [https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3](https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3)
- [https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field](https://secur0.com/en/cna/cve-list/cve-2026-59232-stored-xss-in-prospero-flow-crm-lead-name-field)

## Related threats

- [Roskus Prospero Flow CRM authorization bypass in user API](https://junglewise.ai/threats/cve-2026-114519-missing-authorization-cwe-862-in-the-user-api-of-roskus-prospero)
- [Roskus Prospero Flow CRM cross-site request forgery in order confirmation](https://junglewise.ai/threats/cve-2026-82911-roskus-prospero-flow-crm-cross-site-request-forgery-in-order)
- [Roskus Prospero Flow CRM stored XSS in product photo upload](https://junglewise.ai/threats/cve-2026-81931-roskus-prospero-flow-crm-stored-xss-in-product-photo-upload)
- [Roskus Prospero Flow CRM authorization bypass in supplier API](https://junglewise.ai/threats/cve-2026-78365-roskus-prospero-flow-crm-authorization-bypass-in-supplier-api)
- [Roskus Prospero Flow CRM stored XSS in company logo upload](https://junglewise.ai/threats/cve-2026-78337-roskus-prospero-flow-crm-stored-xss-in-company-logo-upload)