CVE-2025-32019

4.1 mediumEPSS 0.4%

Medium (4.1). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/goharbor/harbor 2.12.4-rc1, 2.12.4-rc1+incompatible, 2.13.1-rc1.

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.

Severity

CVSS 3.1

4.1 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-07-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-f9vc-vf3r-pqqq	Go	github.com/goharbor/harbor	>=2.12.0-rc1 <2.12.4-rc1	2.12.4-rc1
GHSA-f9vc-vf3r-pqqq	Go	github.com/goharbor/harbor	>=2.13.0-rc1 <2.13.1-rc1	2.13.1-rc1
GHSA-f9vc-vf3r-pqqq	Go	github.com/goharbor/harbor	>=2.4.0-rc1.1 <=2.11.2	no fix published
GHSA-f9vc-vf3r-pqqq	Go	github.com/goharbor/harbor	<2.4.0-rc1.0.20250421072404-a13a16383a41	2.4.0-rc1.0.20250421072404-a13a16383a41
GO-2025-3825	Go	github.com/goharbor/harbor	all versions	no fix published
GO-2025-3825	Go	github.com/goharbor/harbor	all versions	no fix published
GO-2025-3825	Go	github.com/goharbor/harbor	>=2.12.0-rc1+incompatible <2.12.4-rc1+incompatible	2.12.4-rc1+incompatible
GO-2025-3825	Go	github.com/goharbor/harbor	>=2.13.0-rc1+incompatible <2.13.1-rc1+incompatible	2.13.1-rc1+incompatible

References

Check your stack JSON