Description
Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in versions 2.11.3 and 2.12.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| goharbor | harbor | >= 2.12.0-rc1, < 2.12.4-rc1, >= 2.13.0-rc1, < 2.13.1-rc1, <= 2.4.0-rc1.1, < 2.11.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250730T213748-1.1 | openSUSE-SU-2025:15405-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/goharbor/harbor | >= 2.12.0-rc1, < 2.12.4-rc1 | 2.12.4-rc1 | GHSA-f9vc-vf3r-pqqq |
| Go | github.com/goharbor/harbor | >= 2.13.0-rc1, < 2.13.1-rc1 | 2.13.1-rc1 | GHSA-f9vc-vf3r-pqqq |
| Go | github.com/goharbor/harbor | >= 2.4.0-rc1.1, <= 2.11.2 | — | GHSA-f9vc-vf3r-pqqq |
| Go | github.com/goharbor/harbor | < 2.4.0-rc1.0.20250421072404-a13a16383a41 | 2.4.0-rc1.0.20250421072404-a13a16383a41 | GHSA-f9vc-vf3r-pqqq |
| Go | github.com/goharbor/harbor | all versions | — | GO-2025-3825 |
| Go | github.com/goharbor/harbor | >= 2.12.0-rc1+incompatible, < 2.12.4-rc1+incompatible | 2.12.4-rc1+incompatible | GO-2025-3825 |
| Go | github.com/goharbor/harbor | >= 2.13.0-rc1+incompatible, < 2.13.1-rc1+incompatible | 2.13.1-rc1+incompatible | GO-2025-3825 |
Advisories 2
- openSUSE-SU-2025:15405-1 govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1634 Harbor: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Jul 23, 2025
References
- https://github.com/goharbor/harbor/security/advisories/GHSA-f9vc-vf3r-pqqq
- https://github.com/goharbor/harbor/commit/76c2c5f7cfd9edb356cbb373889a59cc3217a058
- https://github.com/goharbor/harbor/commit/a13a16383a41a8e20f524593cb290dc52f86f088
- https://github.com/goharbor/harbor/commit/f019430872118852f83f96cac9c587b89052d1e5