CVE-2026-73262 prowler-cloud CVE debrief

Who should care

Cloud security teams, Prowler users, and administrators responsible for report generation and rendering should assess exposure and verify Prowler version 5.37.0 or later is in use.

Why it matters

CVE-2026-73262 is a medium-severity vulnerability in Prowler that allows injected HTML or JavaScript in reports. Defenders should prioritize verifying Prowler version 5.37.0 or later and ensure proper input validation and output encoding.

• Potential for injected HTML or JavaScript to execute in reports
• Risk of unauthorized code execution in report rendering
• Need for input validation and output encoding in report generation
• Verification of Prowler version 5.37.0 or later required

Technical summary

Prowler's HTML output formatter did not properly escape user-supplied resource tags, allowing a cloud principal with modify permissions to inject HTML or JavaScript that would execute when another user opened the report. This issue was fixed in version 5.37.0. The vulnerability affects Prowler versions prior to 5.37.0, and defenders should prioritize verifying Prowler version 5.37.0 or later and ensure proper input validation and output encoding for user-supplied data in reports. Additionally, reviewing and updating report generation and rendering processes can help prevent similar vulnerabilities.

Defensive priority

Defenders should prioritize verifying Prowler version 5.37.0 or later and ensure proper input validation and output encoding for user-supplied data in reports.

Recommended defensive actions

• Verify Prowler version 5.37.0 or later is in use
• Ensure proper input validation and output encoding for user-supplied data in reports
• Review and update report generation and rendering processes to prevent similar vulnerabilities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, additional information on exploitation or victim impact is not available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.