Harbor's repository description page allows for XSS
Priority LOW 19CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed harbor (goharbor): 2.12.4-rc1, 2.13.1-rc1github.com/goharbor/harbor (Go): 2.12.4-rc1, 2.13.1-rc1, 2.4.0-rc1.0.20250421072404-a13a16383a41
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| goharbor | harbor | 2.12.0-rc1 to before 2.12.4-rc1; 2.13.0-rc1 to before 2.13.1-rc1; <= 2.4.0-rc1.1, < 2.11.3 | 2.12.4-rc1, 2.13.1-rc1 | Patch available | CNA |
| — | github.com/goharbor/harbor (Go) | 2.12.0-rc1 to before 2.12.4-rc1 | 2.12.4-rc1 | Patch available | GHSA-f9vc-vf3r-pqqq |
| — | github.com/goharbor/harbor (Go) | 2.13.0-rc1 to before 2.13.1-rc1 | 2.13.1-rc1 | Patch available | GHSA-f9vc-vf3r-pqqq |
| — | github.com/goharbor/harbor (Go) | 2.4.0-rc1.1 – 2.11.2 | — | No fix listed | GHSA-f9vc-vf3r-pqqq |
| — | github.com/goharbor/harbor (Go) | before 2.4.0-rc1.0.20250421072404-a13a16383a41 | 2.4.0-rc1.0.20250421072404-a13a16383a41 | Patch available | GHSA-f9vc-vf3r-pqqq |
- harbor Vendorgoharbor Affected 2.12.0-rc1 to before 2.12.4-rc1; 2.13.0-rc1 to before 2.13.1-rc1; <= 2.4.0-rc1.1, < 2.11.3 Fixed in 2.12.4-rc1, 2.13.1-rc1 Patch available CNA
- github.com/goharbor/harbor (Go) Vendor— Affected 2.12.0-rc1 to before 2.12.4-rc1 Fixed in 2.12.4-rc1 Patch available GHSA-f9vc-vf3r-pqqq
- github.com/goharbor/harbor (Go) Vendor— Affected 2.13.0-rc1 to before 2.13.1-rc1 Fixed in 2.13.1-rc1 Patch available GHSA-f9vc-vf3r-pqqq
- github.com/goharbor/harbor (Go) Vendor— Affected 2.4.0-rc1.1 – 2.11.2 Fixed in — No fix listed GHSA-f9vc-vf3r-pqqq
- github.com/goharbor/harbor (Go) Vendor— Affected before 2.4.0-rc1.0.20250421072404-a13a16383a41 Fixed in 2.4.0-rc1.0.20250421072404-a13a16383a41 Patch available GHSA-f9vc-vf3r-pqqq
Remediation
- Fix · CNA harbor (goharbor) Fixed in 2.12.4-rc1, 2.13.1-rc1
- Fix · GHSA-f9vc-vf3r-pqqq github.com/goharbor/harbor (Go) Fixed in 2.12.4-rc1 Advisory →
- Fix · GHSA-f9vc-vf3r-pqqq github.com/goharbor/harbor (Go) Fixed in 2.13.1-rc1 Advisory →
- Fix · GHSA-f9vc-vf3r-pqqq github.com/goharbor/harbor (Go) Fixed in 2.4.0-rc1.0.20250421072404-a13a16383a41 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-32019
- 2026-10-03 Alias added: GHSA-f9vc-vf3r-pqqq
References
Other 5
- https://github.com/goharbor/harbor/security/advisories/GHSA-f9vc-vf3r-pqqq
- https://github.com/goharbor/harbor/commit/76c2c5f7cfd9edb356cbb373889a59cc3217a058
- https://github.com/goharbor/harbor/commit/a13a16383a41a8e20f524593cb290dc52f86f088
- https://github.com/goharbor/harbor/commit/f019430872118852f83f96cac9c587b89052d1e5
- https://github.com/goharbor/harbor
More goharbor vulnerabilities
- TI-2026-62512 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter CVSS 4.0HIGH 7.1
Sources
- CVE-2025-32019 · CVE Program
- CVE-2025-32019 · NVD
- FIRST EPSS
- GHSA-f9vc-vf3r-pqqq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences