CVE-2025-32019: 
Harbor vulnerability analysis and mitigation

Harbor, an open source trusted cloud native registry project that stores, signs, and scans content, was found to contain a Cross-Site Scripting (XSS) vulnerability. The vulnerability affects versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, where the markdown field in the info tab page could be exploited to inject XSS code (NVD, GitHub Advisory).

The vulnerability is identified as CVE-2025-32019 and has been assigned a CVSS v3.1 base score of 4.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N. The issue specifically relates to improper neutralization of input in the repository description field, allowing for stored XSS attacks. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

The vulnerability allows attackers to inject malicious code through the repository description field, potentially leading to stored XSS attacks. When successful, the attack could result in unauthorized access to sensitive information with low confidentiality impact, though integrity and availability are not affected (GitHub Advisory).

The vulnerability has been fixed in Harbor versions 2.11.3 and 2.12.3. Users are advised to upgrade to these patched versions or later. The fix involves implementing proper HTML escaping for the repository description using template.HTMLEscapeString (GitHub Commit).