EUVD-2026-70229
GHSA-jrwv-32cm-hj63
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible REST API requires high-privilege script-execution credentials (PR:H); the bypass itself is trivial once preconditions exist (AC:L), yielding full server-side Groovy code execution with no scope change.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
3DescriptionCVE.org
In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution.
AnalysisAI
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-existing Groovy scripts via POST /service/rest/v1/script/{name}/run even after administrators explicitly set nexus.scripts.allowCreation=false to disable the scripting subsystem. The execution endpoint did not consult the administrative flag, meaning a hardening action administrators believed fully blocked script activity was silently ineffective against execution of pre-existing scripts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be simultaneously true: (1) the attacker controls a valid Nexus Repository 3 account with the nx-script (script-execution) permission, corresponding to PR:H; (2) the administrator has explicitly set nexus.scripts.allowCreation=false as a hardening measure - instances without this flag set are not in the specific affected security state described; and (3) at least one Groovy script must have been created and stored on the instance prior to the flag being set, since the bypass enables execution of existing scripts only and does not permit creation of new ones. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H) accurately captures the central tensions: network-reachable with low exploitation complexity once preconditions are met, but gated behind high-privilege credentials (PR:H) and a specific target condition (AT:P - the administrator must have already enabled the hardening flag and pre-existing scripts must be present). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Nexus Repository 3.96.0, documented at https://help.sonatype.com/en/sonatype-nexus-repository-3-96-0-release-notes.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit Nexus Repository 3 systems for existing Groovy scripts and review access logs for privileged account activity targeting the /service/rest/v1/script/{name}/run endpoint. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - hold
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today