CVE-2025-32019

MEDIUM

Harbor < 2.11.3, 2.12.0-rc1-2.12.3, 2.13.0-rc1 - Stored Cross-Site Scripting in Info Tab Markdown Field

Title source: llm
STIX 2.1

Description

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.

References (4)

Core 4

Scores

CVSS v3 4.1
EPSS 0.0030
EPSS Percentile 22.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (4)
goharbor/harbor 2.12.0-rc1 - 2.12.4-rc1Go
goharbor/harbor <= 2.4.0-rc1.1, < 2.11.3
goharbor/harbor >= 2.12.0-rc1, < 2.12.4-rc1
goharbor/harbor >= 2.13.0-rc1, < 2.13.1-rc1
Published Jul 23, 2025
Tracked Since Feb 18, 2026