CVE-2026-59232 is a medium-severity cross-site scripting vulnerability affecting Roskus Prospero Flow CRM before version 5.3.7. The issue occurs in the lead index view where user-supplied HTML markup in the lead name field is not properly neutralized. The application uses Blade's unescaped output directive and places the input inside a JavaScript string literal within an onclick attribute, enabling authenticated users with create or update lead permissions to execute arbitrary JavaScript code in the application's origin context.

Exploitation of this vulnerability allows authenticated users with specific permissions to execute arbitrary JavaScript in the context of the application. This could lead to session hijacking, unauthorized actions, or other malicious activities within the user's session. However, the vulnerability requires authentication and specific permissions, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict create and update lead permissions to trusted users only and consider input validation or sanitization on the lead name field to prevent injection of malicious markup.