CVE-2026-73262: Prowler Cloud Security Platform XSS Flaw

CVE-2026-73262 Overview

CVE-2026-73262 is a stored cross-site scripting (XSS) vulnerability in Prowler, an open-source cloud security assessment platform. Versions prior to 5.37.0 fail to HTML-escape resource tag values when rendering HTML reports through prowler/lib/outputs/html/html.py. A cloud principal who can modify a scanned resource's tags can inject HTML or JavaScript that executes when another user opens the generated report. The flaw is tracked under [CWE-79] and is fixed in Prowler version 5.37.0.

Critical Impact
An attacker with permission to modify cloud resource tags can persist arbitrary JavaScript in Prowler HTML reports, executing in the browser context of any analyst who reviews the output.

Affected Products

Prowler (cloud security platform) versions prior to 5.37.0
prowler/lib/outputs/html/html.py HTML report output formatter
Reports generated using unroll_dict and parse_html_string helpers

Discovery Timeline

2026-08-12 - CVE-2026-73262 published to NVD
2026-08-12 - Last updated in NVD database
Prowler 5.37.0 - Fix released via GitHub Release 5.37.0 and Pull Request #12221

Technical Details for CVE-2026-73262

Vulnerability Analysis

Prowler scans cloud environments and produces reports summarizing security findings. Each finding includes metadata such as resource_tags copied directly from the target cloud resource. The HTML formatter concatenates these tag values into report markup without escaping HTML entities. When another user opens the report in a browser, injected <script> or event-handler payloads execute in the report's origin.

Because the attacker controls the tag value on a cloud resource, the payload persists across scans until the tag is removed. Downstream consumers of the report, including security analysts and auditors, become the execution targets. The vulnerability is a classic stored XSS pattern where untrusted input flows into an HTML sink without contextual encoding.

Root Cause

The helper functions unroll_dict and parse_html_string in prowler/lib/outputs/html/html.py assembled tag strings and injected them into the report template as raw HTML. No call to markupsafe.escape or an equivalent encoder wrapped the tag values before rendering. Any attacker-controlled character, including <, >, and quote characters, reached the DOM unmodified.

Attack Vector

Exploitation requires the attacker to hold cloud permissions sufficient to write tags on a resource that Prowler will scan. The attacker sets a tag value containing HTML or JavaScript, such as an <img> tag with an onerror handler. When Prowler completes its next scan and a report consumer opens the resulting HTML file, the payload executes with the privileges of that user's browser session.

python

# Security patch in prowler/lib/outputs/html/html.py
# fix(html): escape provider data in reports (#12221)
+import re
 import sys
 from io import TextIOWrapper
+from urllib.parse import urlparse
 
 import markdown
 from markupsafe import escape

Source: GitHub Commit 6db407e

The patch introduces markupsafe.escape and companion sanitization utilities so that provider-supplied strings are neutralized before being written into the report template.

Detection Methods for CVE-2026-73262

Indicators of Compromise

Cloud resource tags containing HTML control characters such as <, >, ", or onerror= payloads
Prowler HTML reports containing unexpected <script> blocks, iframe elements, or inline event handlers within tag columns
Outbound browser requests from analyst workstations to unfamiliar domains immediately after opening a Prowler report

Detection Strategies

Audit cloud provider tag values across AWS, Azure, and GCP for characters that suggest markup injection attempts
Inspect archived Prowler HTML reports with static scanners or grep patterns targeting script tags and JavaScript URI schemes inside tag fields
Correlate cloud tag modification events (CreateTags, TagResource) with the identity of the principal to spot low-privilege accounts writing unusual tag values

Monitoring Recommendations

Enable CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs for tag-modification API calls and alert on non-standard tag values
Track the Prowler version deployed in CI/CD pipelines and flag any environment still running versions below 5.37.0
Monitor analyst endpoints for browser process activity spawned when opening scan reports from shared storage

How to Mitigate CVE-2026-73262

Immediate Actions Required

Upgrade Prowler to version 5.37.0 or later on every scanning host, CI runner, and container image
Review recent HTML reports produced by vulnerable versions and regenerate them after upgrading
Restrict cloud IAM permissions so that only trusted principals can create or modify resource tags on scanned assets

Patch Information

The fix is available in Prowler 5.37.0. It applies HTML escaping to provider-supplied data before rendering the report, as merged in Pull Request #12221. Refer to GitHub Security Advisory GHSA-c2jg-2778-ggm4 for the full advisory.

Workarounds

Generate reports in non-HTML formats such as JSON or CSV until the upgrade is deployed
Open HTML reports only inside a sandboxed browser profile with JavaScript disabled
Sanitize or strip resource tag values in a pre-processing step before invoking the HTML formatter

bash

# Upgrade Prowler to the patched release
pip install --upgrade 'prowler>=5.37.0'

# Verify the installed version
prowler --version

# Prefer non-HTML output until every host is patched
prowler aws --output-formats json-ocsf csv