EUVD-2026-102154
GHSA-hgx3-p778-vgjq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a stored (persistent) cross-site scripting flaw (CWE-79) in Sonatype Nexus Repository 3, rated Medium (CVSS 5.1, vendor CVSS 4.0 vector). The real-world risk is moderate and clearly bounded by the attacker prerequisites encoded in the vector: AV:N (network reachable) but AT:P and UI:P mean successful exploitation depends on a victim actively opening the malicious package's details in the Browse UI, and PR:L means the attacker must already hold a valid account with edit permission on a hosted R repository. The impact metrics tell a nuanced story: the vendor scored VC:N/VI:N/VA:N (no direct impact to the Nexus system itself) but SC:H/SI:H (high confidentiality/integrity impact to the subsequent system - the viewing user's browser session), which is the expected shape for stored XSS where the payload runs with the victim's privileges. No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a genuine-but-contained issue - a privileged-insider / multi-step social-engineering vector rather than a mass-exploitable unauthenticated RCE. It warrants patching on normal cycles (a fix is available in 3.97.0), not emergency response, unless anonymous users have been granted R-repo edit permission, which materially lowers the attacker bar. Note: the viewing user's own privileges determine real damage - an administrator who browses a malicious package is the worst case. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Stored cross-site scripting in Sonatype Nexus Repository 3 allows an account holding 'edit' permission on a hosted R repository to embed script content in the metadata of an uploaded R package, which then executes in the browser of any user who opens that package's details in the Browse UI, running with the viewing user's own permissions. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P, SC:H/SI:H) requires an authenticated attacker with repository edit rights and a victim who loads the affected package page, and Sonatype rates the issue Medium at 5.1. No public exploit identified at time of analysis; a vendor fix is available in Nexus Repository 3.97.0.
RemediationAI
Vendor-released patch: upgrade to Sonatype Nexus Repository 3.97.0, per the 3.97.0 release notes (https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html) and the vendor advisory (https://support.sonatype.com/hc/en-us/articles/56207477462035/). If upgrading cannot be done immediately, the most effective compensating control is to remove the R repository edit privilege (the nx-repository-view-r-*-edit type privilege) from every account that does not strictly need it: audit roles under Security > Roles, strip that privilege from default and custom roles, and if anonymous access is enabled confirm that it has not been granted any R repository edit permission - otherwise the anonymous user can act as the attacker. The trade-off is that legitimate R package publishing workflows break, so route publishing through a single dedicated service account with the R edit privilege and no interactive browsing use instead of granting it broadly. As a further containment step, consider disabling anonymous access entirely or restricting network reachability of the Browse UI to trusted administrators; this reduces the chance a privileged page is opened by an unintended victim but degrades normal read access for anonymous consumers of all repository formats. Browser-side hardening such as a restrictive Content-Security-Policy on the Nexus web UI can limit script execution but is a defense-in-depth measure and not a substitute for the 3.97.0 upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (improper neutralization of input during web page generation), specifically the stored/persistent variant. Nexus Repository 3 stores R package metadata fields inside the hosted R repository and later renders that stored content in the Browse user interface when a user views a package's detail page; because the metadata is not properly encoded/escaped for the HTML context, markup supplied at upload time becomes executable script at display time. The CVSS 4.0 vector is instructive: VC:N/VI:N/VA:N but SC:H/SI:H indicates the vulnerable Nexus component itself is not the impacted system - the victim's browser, treated as a subsequent system, is where confidentiality and integrity are compromised, so the script runs with the session and privileges of whoever opens the page. The PR:L metric confirms the attacker must be an authenticated account, and the CWE/description note that an enabled anonymous user can also be treated as a user account that holds this permission if an administrator has granted it, which widens the pool of potential writers. AT:P/UI:P captures the attack preconditions: the repository edit privilege and a victim (or automated browser) that actually opens the package details view. The affected CPE string cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:* scopes the issue to the entire Nexus Repository 3 product line as published through the fixed release.
Know when Nexus Repository 3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Primary rating from Vendor (Sonatype) · only source for this CVE.
CVSS VectorVendor: Sonatype
DescriptionCVE.org
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user who holds the 'role create' or 'role up
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Sonatype Nexus Repository 3 fails to enforce a write-authorization check on the NuGet symbol-package upload path, lettin
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Java class-enumeration through the ExtDirect endpoint in Sonatype Nexus Repository 3 allows an unauthenticated, remote a
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Exploit-DB