CVE-2026-73262
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In Prowler prior to 5.37.0, the HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report.
Risk Assessment
Risk of XSS (Cross-Site Scripting) attacks on report users. This could lead to session theft, account takeover, or unauthorized actions in the victim's browser context.
Recommendation
Update Prowler to version 5.37.0 or later, which includes the fix. Ensure that all HTML output is properly escaped.
Original NVD description (English source)
Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.