{"answers":{"affected":"6 open source packages ship an affected version, including prowler-cloud and prowler.","exploited":"There is no known exploitation of CVE-2026-73262 in the wild and no public exploit code.","fix":"Upgrade prowler-cloud to 5.37.0 or later.","what":"CVE-2026-73262 is a medium-severity cross-site scripting vulnerability in prowler-cloud prowler, published on 12 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-73262 and fix it if it is affected.\n\nWhat it is: CVE-2026-73262 is a medium-severity cross-site scripting vulnerability in prowler-cloud prowler, published on 12 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-73262 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- prowler-cloud (PyPI): affected all versions; fixed in 5.37.0\n- prowler-cloud (PyPI): affected all versions; fixed in 5.37.0\n- prowler-cloud (PyPI): affected all versions; fixed in 5.37.0\n- prowler (PyPI): affected all versions; fixed in 5.37.0\n- prowler (PyPI): affected all versions; fixed in 5.37.0\n- prowler (PyPI): affected all versions; fixed in 5.37.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-73262/ (Markdown: https://insights.sbomify.com/CVE-2026-73262/index.md)","id":"CVE-2026-73262","markdown":"https://insights.sbomify.com/CVE-2026-73262/index.md","name":"CVE-2026-73262","record":{"aliases":["GHSA-c2jg-2778-ggm4","PYSEC-2026-3907","PYSEC-2026-3908"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["code_execution","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Cloud security tool","requires_auth":"low_privilege","summary":"Attackers can inject malicious scripts into Prowler HTML reports via unescaped cloud resource tags, executing code when users view the report.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":5.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Prowler: Stored XSS in HTML reports through unescaped cloud resource tags","id":"CVE-2026-73262","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":6,"n_references":4,"next":{"headline":"Prowler: RCE on Prowler App workers via kubeconfig auth-provider cmd-path","id":"CVE-2026-73263"},"packages":[{"ecosystem":"PyPI","fixed":["5.37.0"],"introduced":["0"],"last_affected":[],"package":"prowler","purl":null,"source":"GHSA-c2jg-2778-ggm4"},{"ecosystem":"PyPI","fixed":["5.37.0"],"introduced":["0"],"last_affected":[],"package":"prowler","purl":"pkg:pypi/prowler","source":"GHSA-c2jg-2778-ggm4"},{"ecosystem":"PyPI","fixed":["5.37.0"],"introduced":["0"],"last_affected":[],"package":"prowler","purl":"pkg:pypi/prowler","source":"PYSEC-2026-3907"},{"ecosystem":"PyPI","fixed":["5.37.0"],"introduced":["0"],"last_affected":[],"package":"prowler-cloud","purl":null,"source":"GHSA-c2jg-2778-ggm4"},{"ecosystem":"PyPI","fixed":["5.37.0"],"introduced":["0"],"last_affected":[],"package":"prowler-cloud","purl":"pkg:pypi/prowler-cloud","source":"GHSA-c2jg-2778-ggm4"},{"ecosystem":"PyPI","fixed":["5.37.0"],"introduced":["0"],"last_affected":[],"package":"prowler-cloud","purl":"pkg:pypi/prowler-cloud","source":"PYSEC-2026-3908"}],"prev":{"headline":"Memory corruption in mongoose","id":"CVE-2026-73261"},"products":["prowler"],"published":"2026-08-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-12","vendors":["prowler-cloud"]},"summary":"Attackers can inject malicious scripts into Prowler HTML reports via unescaped cloud resource tags, executing code when users view the report.","url":"https://insights.sbomify.com/CVE-2026-73262/"}