CVE-2026-73262 json
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
published 2mo ago modified 18d ago also EUVD-2026-57222 , GHSA-c2jg-2778-ggm4 , PYSEC-2026-3907 , PYSEC-2026-3908
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.
Patch / fix
- pypi prowler 5.37.0
- pypi prowler-cloud 5.37.0
- prowler prowler 5.37.0
Is CVE-2026-73262 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | prowler | <5.37.0 |
5.37.0 |
| pypi | prowler-cloud | <5.37.0 |
5.37.0 |
Affected products
- prowler-cloud prowler
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/prowler-cloud/prowler/pull/12221
web
-
github.com
/prowler-cloud/prowler/commit/6db407ed3c17d4c73a8f619fdb30580c8465027f
web
-
github.com
/prowler-cloud/prowler/security/advisories/GHSA-c2jg-2778-ggm4
web
-
github.com
/prowler-cloud/prowler/releases/tag/5.37.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-73262
advisory
-
github.com
/prowler-cloud/prowler
package
-
pypi.org
/project/prowler
package
-
github.com
/advisories/GHSA-c2jg-2778-ggm4
advisory
-
pypi.org
/project/prowler-cloud
package
Sources
- CVE List CVE-2026-73262
- GitHub Advisory GHSA-c2jg-2778-ggm4
- NVD CVE-2026-73262
- OSV PYSEC-2026-3907
- OSV PYSEC-2026-3908
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.