CVE-2026-53592 describes a prototype pollution vulnerability in FreeScout's getQueryParam function within /public/js/main.js. The initial mitigation in version 1.8.139 blocked top-level __proto__ keys in URL query parameters but failed to sanitize nested keys such as b[__proto__][polluted]. This allows an attacker to modify Object.prototype via crafted URL query strings on any page loading main.js. The vulnerability is fully addressed in version 1.8.223 with an updated fix that properly sanitizes nested __proto__ keys.

An attacker can manipulate the Object.prototype by injecting nested __proto__ keys through URL query parameters, potentially leading to unexpected behavior or security issues in the client-side JavaScript environment. The impact is limited to low confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L).

A fix is available in FreeScout version 1.8.223, which updates the filtering logic to properly sanitize nested __proto__ keys in URL query parameters. Users should upgrade to version 1.8.223 or later to fully mitigate this vulnerability. No official patch or remediation level was explicitly stated in the advisory, but the updated fix in 1.8.223 is the recommended remediation.