All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2026-73262
MEDIUMpublished 2026-08-12 15:18 UTC · 12 hours ago
5.4
CVSS / 10
// description
Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.
// weaknesses (CWE)
- CWE-79