EUVD-2026-54518
GHSA-v8cg-rx44-f2ff
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required blob store permission; S:C and C:L/I:L capture cross-user session impact when victim views the health-check page.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
1DescriptionCVE.org
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.
AnalysisAI
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inject arbitrary JavaScript into a blob store name, which later executes in the browser of any user who views the system health-check status page. The CVSS 4.0 vector's SC:H/SI:H scores underscore that the subsequent-system impact is high - an attacker-controlled script running in a victim's session can exfiltrate credentials or perform privileged actions on their behalf. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Sonatype has released a fix in version 3.95.0.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) describes the root cause: user-supplied input accepted in one application context (blob store configuration, requiring nexus:blobstores:create or nexus:blobstores:update permission) is persisted to the backend store and later rendered without sufficient output encoding in a separate context (the system health-check status view). The affected product is Sonatype Nexus Repository 3, identified by CPE cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*. Nexus Repository 3 is a Java-based artifact repository manager with a web-based administration UI; the health-check status page aggregates system telemetry including blob store metadata, making it the delivery surface for the stored payload.
RemediationAI
Upgrade Sonatype Nexus Repository 3 to version 3.95.0 or later, which contains the vendor-released patch per Sonatype release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html. If an immediate upgrade is not operationally feasible, restrict the nexus:blobstores:create and nexus:blobstores:update permissions to only the most trusted administrator accounts, reducing the pool of users who can plant a malicious payload - note this workaround does not eliminate risk if any permitted account is compromised or malicious. Additionally, audit existing blob store names for unexpected HTML or script characters as a detection measure. Restrict access to the system health-check status page to minimise the victim surface until patching is complete. Full advisory details are at https://support.sonatype.com/hc/en-us/articles/53871280401555/.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - hold
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today