EUVD-2026-51566
GHSA-qc7h-jr9j-gvx6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects mandatory authenticated access with specific permissions; UI:R because a victim must view the lead index; S:C because payload executes in other users' browser sessions.
Primary rating from Vendor (4daa8cea-433a-44bd-9456-53b127fc289a).
CVSS VectorVendor: 4daa8cea-433a-44bd-9456-53b127fc289a
Lifecycle Timeline
3DescriptionCVE.org
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.
AnalysisAI
Stored cross-site scripting in Roskus Prospero Flow CRM before v5.5.3 allows authenticated users holding the 'create lead' or 'update lead' permission to inject persistent JavaScript payloads via the lead name field. The application renders lead names through Blade's unescaped output directive and embeds them unsanitized inside a JavaScript string literal in an onclick attribute, providing two distinct injection sinks. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS). Prospero Flow CRM is a Laravel/PHP application using the Blade templating engine. The root cause is dual: the lead index view renders the lead name using Blade's unescaped directive ({!! !!}) rather than the safely-escaped {{ }} directive, and the same value is interpolated into a JavaScript string literal within an onclick attribute without encoding. No CPE string was provided in the input data. The fix in commit 8b2633ddb2178c2f79718efdfb906e051ba2f03c introduces a SanitizesInput trait (app/Http/Requests/Concerns/SanitizesInput.php) applied to LeadRequest.php, which calls PHP's strip_tags() on all string request fields in the passedValidation() hook before data reaches the model layer.
RemediationAI
Upgrade to Prospero Flow CRM v5.5.3 or later, available at https://github.com/Roskus/prospero-flow-crm/releases/tag/v5.5.3; note that the CVE record states the fix boundary as 5.3.7, and this discrepancy should be confirmed with the vendor before selecting a target version. The upstream fix (commit 8b2633ddb2178c2f79718efdfb906e051ba2f03c) applies strip_tags() sanitization via the SanitizesInput trait on all string inputs in LeadRequest, preventing HTML markup from reaching storage. If immediate patching is not feasible, restrict the 'create lead' and 'update lead' permissions to fully trusted internal accounts only - this reduces the attacker population but does not eliminate the stored payload risk for accounts that already hold these permissions. Implementing a Content Security Policy (CSP) header that blocks inline script execution is an additional compensating control, though it may interfere with existing onclick-based application functionality.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today