Stored Cross‑Site Scripting (XSS) was discovered in the lead index view of Roskus Prospero Flow CRM. The flaw allows an authenticated user who has permission to create or update leads to insert malicious JavaScript into the lead name field. When the application displays the leads, it renders the name through Blade's unescaped output directive and injects it into an onclick attribute that is evaluated inside a JavaScript string literal, giving the attacker the ability to execute arbitrary code in the context of the application origin.

Vulnerable versions are all releases up to and including 5.3.6. The vendor recommends upgrading to version 5.3.7 or later, with the earliest release that actually tags the fix published as v5.5.3 on GitHub. All other Roskus Prospero Flow CRM installations that have not applied these updates remain susceptible.

The CVSS score of 5.3 indicates a moderate impact, while a very low EPSS of <1% shows that exploitation is unlikely at the moment. The issue is not listed in CISA's KEV catalog. Exploitation requires the attacker to authenticate with a role that can create or update leads, implying that an internal threat actor or a compromised user with such permissions could abuse the flaw to execute code in the browser of anyone viewing the lead list. Proper permissions management and prompt upgrading are therefore essential.