FreeScout’s JavaScript helper function getQueryParam in main.js permits prototype pollution by allowing malicious URL query strings to set properties on Object.prototype. The initial mitigation in version 1.8.139 only blocked top‑level __proto__ keys and did not sanitize nested query structures such as b[__proto__][polluted]=PWNED. Consequently, an attacker can inject arbitrary values into the global Object prototype from any page that loads main.js, potentially altering the behavior of downstream code and compromising application integrity.

The vulnerability affects all installations of the free help desk application provided by freescout-help-desk, specifically versions released before 1.8.223. Versions 1.8.139 through 1.8.222 remain vulnerable, whereas 1.8.223 contains the corrected logic. The issue is /public/js/main.js across all pages that parse query parameters.

With a CVSS score of 4.6, the flaw is considered moderate. The EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by sending a crafted URL to any publicly accessible page that includes main.js, as the vulnerability does. The primary attack vector is a malicious query string that writes into Object.prototype, potentially affecting all subsequent JavaScript execution in the affected application.