CVE-2026-73262

## Summary Prowler's HTML output formatter inserts `finding.resource_tags` into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler HTML report, the payload executes in the report page. ## Impact This is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. ## Gate checks The repository has 13,875 GitHub stars, which is above the 10,000 star floor. `SECURITY.md` is present and does not reject GitHub private reporting. The dedicated GitHub private vulnerability reporting endpoint for `prowler-cloud/prowler` returned `true`. ## Affected versions The vulnerable sink is present in current `master` at commit `329dfdf8e6cb8bc0424fb54b6595408e20969782` and in the latest GitHub release tag `5.28.0`. The package metadata identifies the Python package as `prowler`. ## Technical details The HTML formatter builds each finding row with an f-string in `prowler/lib/outputs/html/html.py`. Neighboring fields are explicitly escaped: - `resource_uid` is escaped at line 85 with `.replace("<", "&lt;").replace(">", "&gt;")`. - `status_extended` is escaped at line 87 with the same pattern. The tag column does not apply equivalent escaping: ```python <td>{parse_html_string(unroll_dict(finding.resource_tags))}</td> ``` `unroll_dict` concatenates tag keys and values into a string, and `parse_html_string` only prefixes each item with an HTML bullet. Neither function escapes `<`, `>`, quotes, or eve