CVE-2026-73262 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Attackers can inject malicious scripts into Prowler HTML reports via unescaped cloud resource tags, executing code when users view the report.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73262?
CVE-2026-73262 is a medium-severity cross-site scripting vulnerability in prowler-cloud prowler, published on 12 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-73262?
6 open source packages ship an affected version, including prowler-cloud and prowler.
| Package | Affected | Fixed in |
|---|---|---|
prowler-cloud PyPI | All versions | 5.37.0 |
prowler-cloud PyPI | All versions | 5.37.0 |
prowler-cloud PyPI | All versions | 5.37.0 |
prowler PyPI | All versions | 5.37.0 |
prowler PyPI | All versions | 5.37.0 |
prowler PyPI | All versions | 5.37.0 |
How do I fix CVE-2026-73262?
Upgrade prowler-cloud to 5.37.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73262 being exploited?
There is no known exploitation of CVE-2026-73262 in the wild and no public exploit code.
Sources
Also known as GHSA-c2jg-2778-ggm4, PYSEC-2026-3907, PYSEC-2026-3908.