CVE-2026-73262: Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-12 · updated 2026-10-24
Weakness: CWE-79

Description

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.

Affected products

prowler-cloud prowler: before 5.37.0

References

https://github.com/prowler-cloud/prowler/commit/6db407ed3c17d4c73a8f619fdb30580c8465027f
https://github.com/prowler-cloud/prowler/pull/12221
https://github.com/prowler-cloud/prowler/releases/tag/5.37.0
https://github.com/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4

Get alerted when CVE-2026-73262 or the next vulnerability affects your stack