{"affected":[{"product":"freescout","source":"CNA: GitHub_M","vendor":"freescout-help-desk","versions":[{"status":"affected","version":"< 1.8.225"}]},{"ecosystem":"","packageName":"FreeScout","product":"FreeScout","source":"GitHub GHSA-jpq8-j69f-mj98","vendor":"","versions":[{"status":"affected","version":"<1.8.226","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-62854","cwes":["CWE-79"],"description":"FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, a user who can edit a mailbox signature can combine a scriptable file uploaded through /uploads/upload with nested tag fragments that bypass Helper::stripDangerousTags(). The resulting external script is served from the same origin, so the script-src 'self' policy permits it when another user opens the affected mailbox reply editor or new-ticket page. The script executes with the victim's FreeScout privileges and can read visible data and perform same-origin actions. This issue is fixed in version 1.8.225.","epss":{"date":"2026-11-10","percentile":0.11904,"score":0.00215},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98"}],"kev":null,"metrics":[{"score":7.6,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},{"score":7.6,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"}],"modifiedAt":1794366652935,"publishedAt":1793983858184,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/commit/315ad05f73886649cb8bc2c014dd74b62cc28502"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/commit/7f6a5042c1326ceaf511f13982178dce036cedbe"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/commit/315ad05f73886649cb8bc2c014dd74b62cc28502"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/commit/7f6a5042c1326ceaf511f13982178dce036cedbe"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/releases/tag/1.8.225"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-jpq8-j69f-mj98","text":"FreeScout: GitHub reports patched versions 1.8.226. Check the advisory for the affected release branch.","url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98"}],"revision":"947fa96bfd3e5f0fa3f38eb7f8d4ec87b6cc4646981672824f69528da1abf801","sources":[{"modifiedAt":1794366652935,"name":"CNA: GitHub_M","retrievedAt":1794370172037,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62854"},{"modifiedAt":1793985513700,"name":"NVD","retrievedAt":1793990256033,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62854"},{"modifiedAt":1784109520000,"name":"GitHub Security Advisories","retrievedAt":1794132009557,"url":"https://github.com/freescout-help-desk/freescout/security/advisories/GHSA-jpq8-j69f-mj98"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794370186609,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62854"}],"ssvc":{"assessedAt":1794366630333,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"FreeScout: Stored XSS in mailbox signature via same-origin JS upload","updatedAt":1794370186609}