prowler
This repo hosts Prowler OSS (CLI and Local Server). Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment for Humans and AI Agents.
View on Github
Activity
- Latest release
- 17h ago
- Total releases
- 197
- Cadence
- ~3 days
- Last 12 months
- 65
Reach
- Stars
- 15.1k
Details
- License
- Apache-2.0
- First release
- Jan 17, 2023
| Version | Released | |
|---|---|---|
5.47.0
minor
|
5.47.0
minor
Dependencies (98)
+ 90 more
Changelog
Compare changes
|
|
5.46.0
minor
|
5.46.0
minor
Dependencies (98)
+ 90 more
Changelog
Compare changes
|
|
5.45.0
minor
|
5.45.0
minor
Dependencies (98)
+ 90 more
Changelog
Compare changes
|
|
5.44.0
minor
|
5.44.0
minor
Dependencies (97)
+ 89 more
Changelog
Compare changes
|
|
5.43.0
minor
|
5.43.0
minor
Dependencies (97)
+ 89 more
Changelog
Compare changes
|
|
5.42.0
minor
|
5.42.0
minor
Dependencies (96)
+ 88 more
Changelog
Compare changes
|
|
5.41.0
minor
|
5.41.0
minor
Dependencies (96)
+ 88 more
Changelog
Compare changes
|
|
5.40.0
minor
|
5.40.0
minor
Dependencies (96)
+ 88 more
Changelog
Compare changes
|
|
5.39.1
minor
|
5.39.1
minor
Dependencies (93)
+ 85 more
Changelog
Compare changes
|
|
5.38.0
minor
|
5.38.0
minor
Dependencies (93)
+ 85 more
Changelog
Compare changes
|
|
5.37.1
patch
|
5.37.1
patch
Dependencies (93)
+ 85 more
Changelog
Compare changes
|
|
5.37.0
minor
|
5.37.0
minor
Dependencies (93)
+ 85 more
Changelog
Compare changes
|
|
5.36.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.36.0
minor
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.35.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.35.0
minor
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.34.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.34.0
minor
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.33.2
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.33.2
patch
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.33.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.33.1
patch
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.33.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.33.0
minor
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.32.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.32.1
patch
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.32.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.32.0
minor
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.31.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.31.1
patch
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.31.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.31.0
minor
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.30.3
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.30.3
patch
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.30.2
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.30.2
patch
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.30.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.30.1
patch
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.30.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.30.0
minor
Dependencies (82)
+ 74 more
Changelog
Compare changes
|
|
5.29.3
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.29.3
patch
Dependencies (81)
+ 73 more
Changelog
Compare changes
|
|
5.29.2
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.29.2
patch
Dependencies (81)
+ 73 more
Changelog
Compare changes
|
|
5.29.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.29.1
patch
Dependencies (81)
+ 73 more
Changelog
Compare changes
|
|
5.29.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.29.0
minor
Dependencies (81)
+ 73 more
Changelog
Compare changes
|
|
5.28.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.28.1
patch
Dependencies (78)
+ 70 more
Changelog
Compare changes
|
|
5.28.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.28.0
minor
Dependencies (78)
+ 70 more
Changelog
Compare changes
|
|
5.27.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.27.1
patch
Dependencies (78)
+ 70 more
Changelog
Compare changes
|
|
5.27.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.27.0
minor
Dependencies (78)
+ 70 more
Changelog
Compare changes
|
|
5.26.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.26.1
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.26.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.26.0
minor
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.25.3
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.25.3
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.25.2
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.25.2
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.25.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.25.1
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.25.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.25.0
minor
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.24.4
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.24.4
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.24.3
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.24.3
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.24.2
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.24.2
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.24.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.24.1
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.24.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.24.0
minor
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.23.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.23.0
minor
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.22.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.22.0
minor
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.21.1
patch
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.21.1
patch
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.21.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.21.0
minor
Dependencies (76)
+ 68 more
Changelog
Compare changes
|
|
5.20.0
minor
1 CVE
CVE-2026-73262
PYSEC-2026-3907
GHSA-c2jg-2778-ggm4
PYSEC-2026-3908
Sep 10, 2026
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
SummaryProwler's HTML output formatter inserts ImpactThis is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. Gate checksThe repository has 13,875 GitHub stars, which is above the 10,000 star floor. Affected versionsThe vulnerable sink is present in current Technical detailsThe HTML formatter builds each finding row with an f-string in
The tag column does not apply equivalent escaping:
Reproduction
A proof HTML fragment using the same formatter structure set Local evidence:
PoCThe minimized generated row below mirrors the vulnerable formatter output. The first and third candidate payloads are escaped controls. The middle payload is the unescaped Browser proof result from the local artifact: RemediationEscape tag keys and values before inserting them into HTML output. Prefer a single HTML escaping helper for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added. Affected versions
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.10.0
3.11.0
3.11.1
3.11.2
3.11.3
3.12.0
3.12.1
+ 173 more Show less
3.13.0
3.13.1
3.14.0
3.15.0
3.15.1
3.15.2
3.15.3
3.16.0
3.16.1
3.16.10
3.16.11
3.16.12
3.16.13
3.16.14
3.16.15
3.16.16
3.16.17
3.16.2
3.16.3
3.16.4
3.16.5
3.16.6
3.16.7
3.16.8
3.16.9
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.6.0
3.6.1
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
4.0.0
4.0.1
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.4.0
4.4.1
4.5.0
4.5.1
4.5.2
4.5.3
4.6.0
4.6.1
4.6.2
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.10.0
5.10.1
5.10.2
5.11.0
5.12.0
5.12.1
5.12.2
5.12.3
5.13.0
5.13.1
5.14.0
5.14.1
5.14.2
5.15.0
5.15.1
5.16.0
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.1
5.2.2
5.2.3
5.20.0
5.21.0
5.21.1
5.22.0
5.23.0
5.24.0
5.24.1
5.24.2
5.24.3
5.24.4
5.25.0
5.25.1
5.25.2
5.25.3
5.26.0
5.26.1
5.27.0
5.27.1
5.28.0
5.28.1
5.29.0
5.29.1
5.29.2
5.29.3
5.3.0
5.30.0
5.30.1
5.30.2
5.30.3
5.31.0
5.31.1
5.32.0
5.32.1
5.33.0
5.33.1
5.33.2
5.34.0
5.35.0
5.36.0
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1
5.6.0
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.8.0
5.8.1
5.9.0
5.9.1
5.9.2
Fixed in
5.37.0
References
Updated Sep 10, 2026 · Source: OSV.dev |
5.20.0
minor
Dependencies (76)
+ 68 more
Changelog
Compare changes
|