FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A Prototype Pollution condition in the "getQueryParam" function "/public/js/main.js" and was addressed in version 1.8.139 by blocking URL query keys matching the pattern "__proto__". However, this mitigation is incomplete: it only filters top-level "__proto__" keys and fails to sanitize nested forms such as "b[__proto__][polluted]=PWNED". As a result, an attacker-controlled URL query string can still write into "Object.prototype" on any page that loads "main.js". Version 1.8.223 contains a updated fix.