CVE-2026-73262: Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resourcetags, assembled by unrolldict and parsehtmlstring, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Prowlerto a version that resolves this vulnerability.Fixed in 5.37.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73262?
CVE-2026-73262 has a medium severity score of 5.4.
How do I fix CVE-2026-73262?
To fix CVE-2026-73262, upgrade Prowler to version 5.37.0 or later.
What type of vulnerability is CVE-2026-73262?
CVE-2026-73262 is classified as a stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-73262?
Any cloud principal who can modify a scanned resource is potentially affected by CVE-2026-73262.
What is the primary impact of CVE-2026-73262?
The primary impact of CVE-2026-73262 is the possibility of executing arbitrary HTML or JavaScript in the context of the affected user.