Is there a patch available for EUVD-2026-29179?

Yes, a patch is available for EUVD-2026-29179. Update the affected software to the latest version immediately.

Sonatype Nexus Repository EUVD-2026-29179

Q: What is the CVSS score of EUVD-2026-29179?

EUVD-2026-29179 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7308 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 Sonatype

GHSA-f5g6-q897-4w8f

XSS Nexus Repository

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 18:47 vuln.today

CVSS changed

May 11, 2026 - 18:22 NVD

5.1 (MEDIUM)

CVE Published

May 11, 2026 - 17:17 nvd

MEDIUM 5.1

DescriptionCVE.org

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

AnalysisAI

Stored cross-site scripting (XSS) in Sonatype Nexus Repository 3.6.0 through 3.91.x allows authenticated users with upload permissions to inject malicious JavaScript into repository content, which executes in the browsers of any user viewing the affected repository directory via the HTML index page. An attacker can perform unauthorized actions within a victim's session context, including potential data theft or privilege escalation depending on the victim's role. The vulnerability requires user interaction (clicking/viewing the malicious content) and prior repository upload access, limiting but not eliminating real-world risk in multi-tenant or open-source repository environments.

Technical ContextAI

The vulnerability stems from improper input validation and output encoding in Nexus Repository's HTML index generation for repository browsing (CWE-79: Improper Neutralization of Input During Web Page Generation). When authenticated users upload files or metadata with malicious JavaScript payloads to a hosted repository, the repository's web interface fails to sanitize these inputs before rendering them in the dynamically generated HTML index page. This allows attackers to bypass content security controls by leveraging their legitimate upload permissions. The affected CPE cpe:2.3:a:sonatype:nexus_repository:*:*:*:*:*:*:*:* indicates all Nexus Repository installations from version 3.6.0 through 3.91.x are vulnerable regardless of deployment mode (cloud, on-premises, or container).

RemediationAI

Upgrade Sonatype Nexus Repository to version 3.92.0 or later, which includes the security patch for this XSS vulnerability. Instructions and release notes are available at https://help.sonatype.com/en/sonatype-nexus-repository-3-92-0-release-notes.html. For organizations unable to immediately upgrade, implement the following compensating controls: restrict upload permissions to trusted administrators only by reviewing and tightening repository role-based access control (RBAC) settings in the Nexus security realm; disable or restrict the HTML index browsing feature if not required for operations by configuring directory indexing settings; implement a web application firewall (WAF) rule to sanitize or block requests containing common JavaScript payload patterns in repository index responses; and educate repository users to avoid clicking on suspicious file names or content within repository listings. Note that these controls do not eliminate the vulnerability but reduce the attack surface. Consult https://support.sonatype.com/hc/en-us/articles/51592065985939 for detailed advisory information and version-specific upgrade guidance.