CVE-2026-73262: Prowler-Cloud Prowler

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.

Affected products

• Prowler-Cloud Prowler: before 5.37.0 (fixed in 5.37.0)

Published 2026-08-12. Last modified 2026-09-09.