EUVD-2026-54513
GHSA-65xx-g4qc-4g4m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API (AV:N), no special conditions (AC:L), requires nx-datastores-update permission (PR:L), no user interaction needed (UI:N), full C/I/A triad via SQL injection to OS RCE; scope unchanged as OS impact is within the Nexus process boundary.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
2DescriptionCVE.org
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.
AnalysisAI
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permission, who can exploit an insufficiently restricted HikariCP connection-pool property passthrough in the DataStore configuration API to inject arbitrary SQL via the connectionInitSql property. On the default H2 embedded database backend - common in non-production and smaller deployments - H2's ability to invoke Java methods from SQL allows this injection to escalate to OS-level command execution as the Nexus process user. No public exploit has been identified at time of analysis, but the H2-to-RCE escalation path is a well-understood Java ecosystem technique that lowers the practical skill bar significantly.
Technical ContextAI
HikariCP is a high-performance Java JDBC connection pool library that accepts a connectionInitSql property - a SQL statement executed on every newly opened connection, intended for session-level initialization. Nexus Repository 3 (CPE: cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*) exposes a DataStore configuration API that passes properties to the underlying HikariCP pool without adequately allowlisting which properties are permissible. CWE-94 (Improper Control of Generation of Code - Code Injection) is the root cause class: user-supplied input is accepted into a property that directly controls runtime SQL execution against the database engine. The default H2 embedded database is particularly dangerous because H2 SQL supports CALL and CSVREAD functions as well as direct Java class instantiation through INIT scripts, enabling SQL injection to pivot into arbitrary JVM code execution. External database backends such as PostgreSQL would still be vulnerable to the SQL injection primitive, but the RCE escalation path depends on the configured database user's privileges and the target engine's feature set.
RemediationAI
Upgrade to Sonatype Nexus Repository 3.95.0 or later, which restricts the set of HikariCP connection-pool properties that can be set through the DataStore configuration API. The vendor security advisory is available at https://support.sonatype.com/hc/en-us/articles/53890127489427/ and the release notes documenting the fix are at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html. As a compensating control prior to patching, audit all role assignments and remove the nx-datastores-update permission from any principal that does not strictly require DataStore reconfiguration capabilities - this directly eliminates the attack surface for unprivileged accounts, though it does not fix the underlying API flaw. Organizations running the default H2 embedded database should treat this as an elevated priority given the RCE escalation path; migrating to an external PostgreSQL backend reduces but does not eliminate risk (SQL injection still applies). Network-level ACLs restricting access to the Nexus API management port to trusted administrator hosts are a useful defence-in-depth measure but should not substitute for the patch.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - hold
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today