4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32019

CVE-2025-32019: Harbor repository description page has Cross-site Scripting vulnerability

Impact

In the Harbor repository information, it is possible to inject code resulting in a stored XSS issue.

Patches

Harbor v2.12.3 Harbor 2.11.3

Workarounds

References

Credit

gleb.razvitie@gmail.com

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32019

CVE-2025-32019:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/goharbor/harbor	go	>= 2.12.0-rc1, < 2.12.4-rc1	2.12.4-rc1
github.com/goharbor/harbor	go	>= 2.13.0-rc1, < 2.13.1-rc1	2.13.1-rc1
github.com/goharbor/harbor	go	>= 2.4.0-rc1.1, <= 2.11.2
github.com/goharbor/harbor	go	< 2.4.0-rc1.0.20250421072404-a13a16383a41	2.4.0-rc1.0.20250421072404-a13a16383a41

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is a stored Cross-Site Scripting (XSS) issue in the Harbor repository information page. The analysis of the provided patches confirms this. All three commits (76c2c5f7cfd9edb356cbb373889a59cc3217a058, a13a16383a41a8e20f524593cb290dc52f86f088, and f019430872118852f83f96cac9c587b89052d1e5) point to the same code change in the src/server/v2.0/handler/repository.go file. The change is within the UpdateRepository function of the repositoryAPI struct. The patch introduces the use of template.HTMLEscapeString to sanitize the Description field of the repository before it's updated. This indicates that previously the input was not being sanitized, thus allowing for the injection of malicious scripts. When another user views the repository information, the malicious script would execute in their browser. Therefore, the repositoryAPI.UpdateRepository function is the vulnerable function as it is responsible for processing and storing the tainted data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-32019: Harbor repository description page has Cross-site Scripting vulnerability

Impact

Patches

Workarounds

References

Credit

CVE-2025-32019:

4.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-32019: Harbor repository description page has Cross-site Scripting vulnerability

Impact

Patches

Workarounds

References

Credit

4.1

4.1

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI