CVE-2025-32019
Harbor's repository description page allows for XSS
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Harbor's repository description page allows for XSS
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
- Record
CVE-2025-32019- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-22474
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
- Record
EUVD-2025-22474- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f9vc-vf3r-pqqq
Harbor repository description page has Cross-site Scripting vulnerability
Impact
In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue.
Patches
Harbor v2.12.3 Harbor 2.11.3
Workarounds
No
References
Credit
- Record
GHSA-f9vc-vf3r-pqqq- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
- Record
CVE-2025-32019- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Harbor's repository description page allows for XSS
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
- Record
CVE-2025-32019- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-f9vc-vf3r-pqqq
Harbor repository description page has Cross-site Scripting vulnerability
Impact
In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue.
Patches
Harbor v2.12.3 Harbor 2.11.3
Workarounds
No
References
Credit
- Record
GHSA-f9vc-vf3r-pqqq- CVSS 3.1
- 4.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-harbor-2025-32019 No score
Harbor's repository description page allows for XSS
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0 and 2.13.0, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
- Record
BIT-harbor-2025-32019- Updated
- 2026-11-02
OSVGO-2025-3825 No score
Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor
Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/goharbor/harbor before v2.4.0-rc1.0.20250421072404-a13a16383a41.
- Record
GO-2025-3825- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15405-1 No score
govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media
These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/goharbor/harborGo |
2.12.0-rc1 up to 2.12.4-rc1 | 2.12.4-rc1 |
github.com/goharbor/harborGo |
2.13.0-rc1 up to 2.13.1-rc1 | 2.13.1-rc1 |
github.com/goharbor/harborGo |
2.4.0-rc1.1 to 2.11.2 | None known |
github.com/goharbor/harborGo |
before 2.4.0-rc1.0.20250421072404-a13a16383a41 | 2.4.0-rc1.0.20250421072404-a13a16383a41 |
harborBitnami |
before 2.11.3 | 2.11.3 |
github.com/goharbor/harborGo |
All versions | None known |
github.com/goharbor/harborGo |
2.12.0-rc1+incompatible up to 2.12.4-rc1+incompatible | 2.12.4-rc1+incompatible |
github.com/goharbor/harborGo |
2.13.0-rc1+incompatible up to 2.13.1-rc1+incompatible | 2.13.1-rc1+incompatible |
govulncheck-vulndbopenSUSE:Tumbleweed From an advisory covering 56 CVEs |
before 0.0.20250730T213748-1.1 | 0.0.20250730T213748-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32019 is a medium vulnerability (CVSS 4.1) in Goharbor Harbor, published July 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in github.com/goharbor/harbor 2.12.4-rc1.
References
github.com/goharbor/harbor/security/advisories/GHSA-f9vc-vf3r-pqqq
nvd.nist.gov/vuln/detail/CVE-2025-32019
Show 58 moreShow less
suse.com/security/cve/CVE-2024-44905