From 7cbc56adb3576f0bb099405c5b43b86b3dcbec5f Mon Sep 17 00:00:00 2001
From: pedrooot <pedromarting3@gmail.com>
Date: Tue, 13 Oct 2026 17:22:55 +0200
Subject: [PATCH] fix(html): escape the compliance column

---
 .../html-compliance-escape.security.md          |  1 +
 prowler/lib/outputs/html/html.py                |  2 +-
 tests/lib/outputs/html/html_test.py             | 17 +++++++++++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 prowler/changelog.d/html-compliance-escape.security.md

diff --git a/prowler/changelog.d/html-compliance-escape.security.md b/prowler/changelog.d/html-compliance-escape.security.md
new file mode 100644
index 0000000000..98b4b12a04
--- /dev/null
+++ b/prowler/changelog.d/html-compliance-escape.security.md
@@ -0,0 +1 @@
+HTML report compliance column is now escaped, so framework names and requirement IDs containing markup are shown as text instead of being rendered by the browser
diff --git a/prowler/lib/outputs/html/html.py b/prowler/lib/outputs/html/html.py
index 60428bede7..da3faa8b1c 100644
--- a/prowler/lib/outputs/html/html.py
+++ b/prowler/lib/outputs/html/html.py
@@ -116,7 +116,7 @@ class HTML(Output):
                             <td>{str(escape(finding.status_extended)).replace("_", "<wbr />_")}</td>
                             <td><p class="show-read-more">{HTML.process_markdown(str(escape(finding.metadata.Risk)))}</p></td>
                             <td><p class="show-read-more">{HTML.process_markdown(str(escape(finding.metadata.Remediation.Recommendation.Text)))}</p> <a class="read-more" href="{str(escape(_safe_url(finding.metadata.Remediation.Recommendation.Url)))}"><i class="fas fa-external-link-alt"></i></a></td>
-                            <td><p class="show-read-more">{parse_html_string(unroll_dict(finding.compliance, separator=": "))}</p></td>
+                            <td><p class="show-read-more">{parse_html_string(str(escape(unroll_dict(finding.compliance, separator=": "))))}</p></td>
                         </tr>
                         """)
         except Exception as error:
diff --git a/tests/lib/outputs/html/html_test.py b/tests/lib/outputs/html/html_test.py
index 1590d29742..6c39e43249 100644
--- a/tests/lib/outputs/html/html_test.py
+++ b/tests/lib/outputs/html/html_test.py
@@ -910,6 +910,23 @@ class TestHTML:
         assert "&#x2022;key&amp;&lt;&gt;&#39;&#34;&lt;img" in output_data
         assert "=value&amp;&lt;&gt;&#39;&#34;&lt;img" in output_data
 
+    def test_transform_escapes_compliance(self):
+        xss_payload = '<img src=x onerror="window.PROWLER_COMPLIANCE_XSS=1">'
+        findings = [
+            generate_finding_output(
+                compliance={f"Framework{xss_payload}-1.0": [xss_payload, "1.1"]},
+            )
+        ]
+
+        output_data = HTML(findings).data[0]
+
+        assert xss_payload not in output_data
+        assert (
+            "&#x2022;Framework&lt;img src=x "
+            "onerror=&#34;window.PROWLER_COMPLIANCE_XSS=1&#34;&gt;-1.0: "
+            "&lt;img src=x onerror=&#34;window.PROWLER_COMPLIANCE_XSS=1&#34;&gt;, 1.1"
+        ) in output_data
+
     def test_transform_escapes_metadata_fields(self):
         finding = generate_finding_output()
         finding.metadata.Severity = MagicMock(value='<img data-field="severity" src=x>')