Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted resource tags into generated reports without proper HTML escaping. Specifically, the finding.resource_tags, assembled by unroll_dict and parse_html_string, could contain malicious HTML or JavaScript if a cloud principal can modify a scanned resource tag. This leads to a stored cross-site scripting vulnerability that executes when another user opens the report. The vulnerability affects versions prior to 5.37.0 and is resolved in 5.37.0.

An attacker with permission to modify resource tags in the scanned cloud environment can inject malicious HTML or JavaScript into prowler reports. When other users open these reports, the injected code executes in their browsers, potentially leading to information disclosure or other client-side impacts. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, user interaction required, and partial confidentiality and integrity impact without availability impact.

Upgrade prowler to version 5.37.0 or later, where this vulnerability is fixed by properly escaping HTML in resource tags within the report output. No other mitigation is indicated by the vendor advisory.