FreeScout stores mailbox signatures without complete HTML filtering; only four tags are blocked and event handler attributes are left intact. When an authenticated user with signature permission saves a signature containing elements such as <img>, <svg>, or <details> that carry onerror/onload handlers, the malicious code is persisted in the database. The signature is later rendered as raw HTML and inserted into the page via JavaScript. The embedded handlers execute automatically whenever any agent or administrator opens a conversation, enabling session hijacking, phishing overlays that bypass content‑security policies in some browsers, and escalation to admin capabilities such as mass‑assignment and even worm‑like propagation across mailboxes.

The vulnerability affects the free, self‑hosted help‑desk platform Freescout, version 1.8.212 and earlier.

The flaw carries a CVSS score of 8.5, indicating high severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog. Attackers must be authenticated and be granted the ACCESS_PERM_SIGNATURE permission, a delegatable, non‑admin right, to insert malicious signatures. Once injected, the payload runs immediately without victim interaction, making exploitation straightforward for anyone who can reach a mailbox conversation on the affected system.