CVE-2026-73262 is a reflected cross-site scripting vulnerability in Prowler, the cloud security compliance and vulnerability scanner. The flaw lives in the HTML report generation path where cloud resource tags — data retrieved via AWS/Azure APIs — flow through the unroll_dict and parse_html_string functions without HTML encoding. If an attacker controls a resource tag (which any principal with tag-write permissions can write), they can embed malicious HTML or JavaScript that executes when a user opens the generated report.
The critical insight here is that Prowler's users are security teams, compliance officers, and auditors — precisely the population with the broadest credential footprint across cloud environments. A successful exploit doesn't target a single victim; it targets everyone who opens that report. An attacker with access to a scanned account can poison a resource tag, wait for the security team to run Prowler, and harvest sessions from the report. The CVSS 5.4 captures technical severity but understates this operational reality.
The vulnerability persisted through version 5.36.x because the team treated cloud API responses as trusted infrastructure data rather than untrusted external input. Cloud resource tags are not controlled by Prowler — they can be written by any principal with tag permissions inside the account being scanned. The mental model error was treating the cloud provider's data model as inherently safe, rather than treating every data point crossing into HTML as requiring output encoding.
If you're running Prowler, upgrade to 5.37.0 immediately. More importantly, audit any automated workflows that consume Prowler reports — CI/CD pipelines, ticketing integrations, or scheduled scans that render HTML automatically. Those are the high-value targets. For security tooling projects: treat every output format as a security boundary. The finding logic gets scrutiny; the report generation path does not — and that's exactly where this class of flaw accumulates.