Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed prowler (prowler-cloud): 5.37.0prowler (PyPI): 5.37.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| prowler-cloud | prowler | before 5.37.0 | 5.37.0 | Patch available | CNA |
| — | prowler (PyPI) | before 5.37.0 | 5.37.0 | Patch available | GHSA-c2jg-2778-ggm4 |
| — | prowler-cloud (PyPI) | before 5.37.0 | 5.37.0 | Patch available | GHSA-c2jg-2778-ggm4 |
- prowler Vendorprowler-cloud Affected before 5.37.0 Fixed in 5.37.0 Patch available CNA
- prowler (PyPI) Vendor— Affected before 5.37.0 Fixed in 5.37.0 Patch available GHSA-c2jg-2778-ggm4
- prowler-cloud (PyPI) Vendor— Affected before 5.37.0 Fixed in 5.37.0 Patch available GHSA-c2jg-2778-ggm4
Remediation
- Fix · CNA prowler (prowler-cloud) Fixed in 5.37.0
- Fix · GHSA-c2jg-2778-ggm4 prowler (PyPI) Fixed in 5.37.0 Advisory →
- Fix · GHSA-c2jg-2778-ggm4 prowler-cloud (PyPI) Fixed in 5.37.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73262
- 2026-10-03 Alias added: GHSA-c2jg-2778-ggm4
References
Other 5
- https://github.com/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4
- https://github.com/prowler-cloud/prowler/pull/12221
- https://github.com/prowler-cloud/prowler/commit/6db407ed3c17d4c73a8f619fdb30580c8465027f
- https://github.com/prowler-cloud/prowler/releases/tag/5.37.0
- https://github.com/prowler-cloud/prowler
More prowler-cloud vulnerabilities
- TI-2026-51398 Prowler: Server-Side Request Forgery (SSRF) in Lighthouse Provider CVSS 3.1HIGH 7.6
- TI-2026-51397 Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path CVSS 3.1CRITICAL 9.9
Sources
- CVE-2026-73262 · CVE Program
- CVE-2026-73262 · NVD
- FIRST EPSS
- GHSA-c2jg-2778-ggm4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences