CVE-2025-32019CWE-79

Harbor's repository description page allows for XSS

Medium · published July 23, 2025

CVSS v3.1
4.1
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-07-23T20:38Z
EPSS history
Timeline
  • 23 JUL 20:38Z
    Harbor's repository description page allows for XSS
    cvelistv5