{"id":"CVE-2026-73262","title":"Prowler is a cloud security platform","summary":"Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTM…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"prowler","product":"prowler","affected":["prowler < 5.37.0","prowler-cloud < 5.37.0"],"patched":["prowler 5.37.0","prowler-cloud 5.37.0"],"published":"2026-08-12","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:58:37.713","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73262","references":[{"url":"https://github.com/prowler-cloud/prowler/commit/6db407ed3c17d4c73a8f619fdb30580c8465027f","label":"security-advisories@github.com"},{"url":"https://github.com/prowler-cloud/prowler/pull/12221","label":"security-advisories@github.com"},{"url":"https://github.com/prowler-cloud/prowler/releases/tag/5.37.0","label":"security-advisories@github.com"},{"url":"https://github.com/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73262"},{"url":"https://github.com/prowler-cloud/prowler"},{"url":"https://github.com/advisories/GHSA-c2jg-2778-ggm4"},{"url":"https://pypi.org/project/prowler"},{"url":"https://pypi.org/project/prowler-cloud"}],"tags":["nvd","osv","pip","ghsa"],"epss":0.00215,"epssPercentile":0.1216,"aliases":["GHSA-c2jg-2778-ggm4","PYSEC-2026-3907","PYSEC-2026-3908"],"ecosystem":"pip","ingestedAt":"2026-09-08T19:08:49.635Z","slug":"CVE-2026-73262","body":"## Overview\n\nProwler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73262)\n\nAffected packages:\n\n- `prowler < 5.37.0`\n- `prowler-cloud < 5.37.0`\n\nPatched in:\n\n- `prowler 5.37.0`\n- `prowler-cloud 5.37.0`\n\nSource: https://osv.dev/vulnerability/GHSA-c2jg-2778-ggm4","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}