CVE-2026-73262

Name of the Vulnerable Software and Affected Versions Prowler versions prior to 5.37.0

Description The HTML output formatter in the file prowler/lib/outputs/html/html.py fails to perform HTML escaping when inserting finding.resource tags into generated reports. These tags are assembled using the unroll dict() and parse html string() functions. This allows a cloud principal with permissions to modify scanned resource tags to inject malicious HTML or JavaScript, which then executes in the browser of any user who opens the report. This is a stored cross-site scripting (XSS) issue, where a script is permanently stored on the server or in a database and served to other users.

Recommendations Update to version 5.37.0.