Sonatype Nexus Security Advisory
Date: October 15, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.28.0 up to, but not including, 3.97.0
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.97.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N = 5.1 (Medium)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-97667
Summary
A vulnerability in the Browse user interface of Sonatype Nexus Repository 3 allows a user that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface. The script runs with the permissions of the viewing user. If the viewing user is an administrator, the script can use the administrator’s access.
In this advisory, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account in Nexus Repository 3 and can hold this permission if an administrator grants it.
At the time of this advisory, Sonatype is not aware of this vulnerability being actively exploited in the wild.
Recommendation
Users are advised to upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.97.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.
The fix applies to existing content. R packages that were uploaded before the upgrade no longer run script when you view them after the upgrade.
Immediate Mitigation Options
There is no configuration change that fully mitigates this vulnerability without upgrading. The following measures reduce exposure:
-
Restrict the permissions: Grant edit permission on hosted R repositories (
nx-repository-view-r-*-edit, or any role that contains it) only to fully trusted users. Do not grant it to the anonymous user. - Remove unused repositories: If your instance does not need a hosted R repository, delete it.
- Network-level access control: Restrict access to the Nexus Repository web interface to trusted networks.
Credit
This issue was discovered and reported responsibly by Uttam Sabhadiya via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker can run script in the browser of a user who views an affected package in the Browse user interface. The script runs with the permissions of that user. If the user is an administrator, the attacker can perform administrative actions on the instance.
Q: What preconditions must be met in order to be vulnerable?
A: The instance must have at least one hosted R repository. R repositories are not created by default. The attacker must have network access to the Nexus Repository web interface. The attacker must hold the edit privilege on a hosted R repository (nx-repository-view-r-<repository>-edit), directly or through a role. This includes the anonymous user if an administrator grants this privilege to it. Another user must then open the details of the attacker’s package in the Browse user interface.
Q: Are there implications associated with this advisory itself?
A: Publishing this advisory may enable malicious actors to attempt to exploit this vulnerability. Affected users should assess their exposure and apply the recommended upgrade or interim mitigation as soon as practicable.
Q: Why is Sonatype making this information available?
A: Sonatype follows responsible disclosure practices. We coordinate with security researchers who report vulnerabilities to us in good faith, and we publish advisories after a fix is available so that users can take informed action to protect their installations.