Executive brief
Prowler is an open-source tool that audits cloud infrastructure security and generates HTML reports of findings. The tool inserts resource tags (metadata labels applied to cloud resources) directly into HTML reports without escaping special characters. An attacker who can tag cloud resources can inject malicious JavaScript that executes when a security team member views the report, potentially altering findings or stealing sensitive data from the report page.
Technical details
This is a stored XSS vulnerability (CWE-79) in the HTML formatter at prowler/lib/outputs/html/html.py. The vulnerability exists because the formatter calls parse_html_string(unroll_dict(finding.resource_tags)) without HTML entity encoding. Neighboring fields (resource_uid and status_extended) are correctly escaped using .replace("<", "<").replace(">", ">"), but the tag column bypasses this protection. An attacker who can add or modify tags on a scanned cloud resource can inject payloads like <img src=x onerror="malicious_code">. The attack requires: (1) permissions to tag resources in the target cloud account, (2) those resources to be scanned by Prowler, and (3) a user to open the generated HTML report in a browser. Upon report rendering, the injected script executes in the same origin context, allowing DOM manipulation, finding alteration, and access to all report content visible to the browser. The vulnerability affects prowler versions up to 5.36.0; version 5.37.0 patches the issue with proper HTML escaping.
Affected products
- Prowler prowler <= 5.36.0
- Prowler prowler-cloud <= 5.36.0
Timeline
- 2026-08-03: disclosed: Published by GitHub Advisory Database
- 2026-09-08: patched: Version 5.37.0 released with fix
- 2026-09-08: advisory: GHSA-c2jg-2778-ggm4 reviewed and updated