CVE-2026-97667 PUBLISHED

Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI

Assigner: Sonatype
Reserved: 24.09.2026 Published: 15.10.2026 Updated: 15.10.2026

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
CVSS Score: 5.1

Product Status

Vendor Sonatype
Product Nexus Repository 3
Versions Default: unaffected
  • affected from 3.28.0 to 3.97.0 (excl.)

Credits

  • Uttam Sabhadiya finder

References

Problem Types

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE