CVE-2025-32019: Goharbor Harbor

Medium severity, CVSS 4.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.

Affected products

• Goharbor Harbor: from 2.12.0-rc1, before 2.12.4-rc1 (fixed in 2.12.4-rc1); from 2.13.0-rc1, before 2.13.1-rc1 (fixed in 2.13.1-rc1)

Published 2025-07-23. Last modified 2026-06-17.