Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

prowler

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.4PyPIAmendedPublished

    Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

    CVE-2026-73262 · GHSA-c2jg-2778-ggm4

    Affected
    • PyPI prowler <= 5.36.0
    Fixed in
    5.37.0· Vendor fix available
    Issue
    Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler HTML report, the payload executes in the report page. Impact This is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checks The repository has 13,875 GitHub stars, which is above the 10,000 star floor. SECURITY.md is present and does not reject GitHub private…

    Recommended action: Upgrade to 5.37.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →