{"id":"CVE-2025-32019","aliases":["BIT-harbor-2025-32019","EUVD-2025-22474","GHSA-f9vc-vf3r-pqqq","GO-2025-3825","openSUSE-SU-2025:15405-1"],"status":"published","title":"Harbor's repository description page allows for XSS","description":"Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00368,"percentile":0.30915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2025-07-23T14:40:05Z","modified":"2026-10-28T02:30:20Z","fixes":[{"ecosystem":"Go","package":"github.com/goharbor/harbor","fixed_in":["2.12.4-rc1","2.13.1-rc1","2.4.0-rc1.0.20250421072404-a13a16383a41","2.12.4-rc1+incompatible","2.13.1-rc1+incompatible"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"harbor","fixed_in":["2.11.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.0-rc1"},{"fixed":"2.12.4-rc1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0-rc1"},{"fixed":"2.13.1-rc1"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0-rc1.1"},{"last_affected":"2.11.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-rc1.0.20250421072404-a13a16383a41"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"2.12.0-rc1"},{"fixed":"2.12.4-rc1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"2.13.0-rc1"},{"fixed":"2.13.1-rc1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0-rc1.1"},{"last_affected":"2.11.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.0-rc1.0.20250421072404-a13a16383a41"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"2.12.0-rc1+incompatible"},{"fixed":"2.12.4-rc1+incompatible"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/goharbor/harbor","ranges":[{"type":"SEMVER","events":[{"introduced":"2.13.0-rc1+incompatible"},{"fixed":"2.13.1-rc1+incompatible"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250730T213748-1.1"}]}],"bundled":56}],"products":[{"vendor":"goharbor","product":"harbor"},{"vendor":"harbor","product":"harbor"}],"references":[{"url":"https://github.com/goharbor/harbor/security/advisories/GHSA-f9vc-vf3r-pqqq","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://github.com/goharbor/harbor/commit/76c2c5f7cfd9edb356cbb373889a59cc3217a058","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/goharbor/harbor/commit/a13a16383a41a8e20f524593cb290dc52f86f088","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/goharbor/harbor/commit/f019430872118852f83f96cac9c587b89052d1e5","tags":["x_refsource_MISC","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32019","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f9vc-vf3r-pqqq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32019.json","tags":["advisory"]},{"url":"https://github.com/goharbor/harbor","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-51471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6624","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-32019","title":"Harbor's repository description page allows for XSS","description":"Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.","status":"published","published":"2025-07-23T20:38:10.966Z","modified":"2025-07-23T20:47:47.745Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:46.42892Z"}],"euvd":[{"id":"EUVD-2025-22474","description":"Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.","status":"published","published":"2025-07-23T20:38:10Z","modified":"2025-07-23T20:47:47Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:04.806066Z"}],"ghsa":[{"id":"GHSA-f9vc-vf3r-pqqq","title":"Harbor repository description page has Cross-site Scripting vulnerability","description":"### Impact\n\nIn the Harbor repository information, it is possible to inject code resulting in a stored XSS issue.\n\n### Patches\nHarbor v2.12.3 Harbor 2.11.3\n\n### Workarounds\nNo\n\n### References\n\n### Credit\ngleb.razvitie@gmail.com","status":"published","published":"2025-07-23T14:40:05Z","modified":"2025-07-23T22:15:00Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:51.864708Z"}],"nvd":[{"id":"CVE-2025-32019","description":"Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.","status":"published","published":"2025-07-23T21:15:26.037Z","modified":"2026-06-17T09:11:19.87Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:19.382856Z"}],"osv":[{"id":"CVE-2025-32019","title":"Harbor's repository description page allows for XSS","description":"Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.","status":"published","published":"2025-07-23T20:38:10.966Z","modified":"2026-10-28T02:30:20.674621754Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-f9vc-vf3r-pqqq","title":"Harbor repository description page has Cross-site Scripting vulnerability","description":"### Impact\n\nIn the Harbor repository information, it is possible to inject code resulting in a stored XSS issue.\n\n### Patches\nHarbor v2.12.3 Harbor 2.11.3\n\n### Workarounds\nNo\n\n### References\n\n### Credit\ngleb.razvitie@gmail.com","status":"published","published":"2025-07-23T14:40:05Z","modified":"2025-07-29T19:44:46.880538Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"BIT-harbor-2025-32019","title":"Harbor's repository description page allows for XSS","description":"Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0 and 2.13.0, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.","status":"published","published":"2025-07-29T05:40:29.32Z","modified":"2026-03-20T10:00:15.058089Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2025-3825","title":"Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor","description":"Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/goharbor/harbor before v2.4.0-rc1.0.20250421072404-a13a16383a41.","status":"published","published":"2025-07-29T18:49:33Z","modified":"2026-03-03T04:56:44.465444Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15405-1","title":"govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-04T00:00:00Z","modified":"2026-03-23T04:53:44.42671Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}