In short
- CVE-2025-32019 is a MEDIUM (CVSS 4.1) vulnerability affecting github.com/goharbor/harbor.
- Chance of exploitation in the next 30 days (EPSS): 0.37%, higher than 30.6% of all vulnerabilities.
- Fix: update to 2.12.4-rc1, 2.12.4-rc1+incompatible, 2.13.1-rc1, 2.13.1-rc1+incompatible or later.
| Package | Affected versions | Patched versions |
|---|
| github.com/goharbor/harbor Go | ≥ 2.12.0-rc1, < 2.12.4-rc1≥ 2.12.0-rc1+incompatible, < 2.12.4-rc1+incompatible≥ 2.13.0-rc1, < 2.13.1-rc1≥ 2.13.0-rc1+incompatible, < 2.13.1-rc1+incompatible≥ 2.4.0-rc1.1, ≤ 2.11.2< 2.4.0-rc1.0.20250421072404-a13a16383a41all versions
| 2.12.4-rc12.12.4-rc1+incompatible2.13.1-rc12.13.1-rc1+incompatible2.4.0-rc1.0.20250421072404-a13a16383a41
|
Description
Impact
In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue.
Patches
Harbor v2.12.3 Harbor 2.11.3
Workarounds
No
References
Credit
[email protected]
NVD description
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
More vulnerabilities in github.com/goharbor/harbor
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free