This vulnerability arises when FreeScout converts plain‑text URLs in email bodies into anchor tags without escaping quotation marks. The resulting href attribute can be broken out of, permitting attackers to inject arbitrary HTML attributes or script code. The flaw is a classic stored cross‑site scripting weakness.

The issue affects the FreeScout Help Desk application, specifically any installation using a version older than 1.8.213. All users of those versions who receive or render email content are potentially affected.

The CVSS score of 6.1 indicates a moderate severity. No EPSS data is currently available and the vulnerability is not listed in the CISA KEV catalog. An attacker would need the ability to inject content that passes through the linkify() function, such as through an email message or a user‑submitted comment. Once the crafted URL is rendered, the injected HTML can execute script or alter style, leading to potential data theft or session hijacking if the victim interacts with the affected page content.