Sonatype Nexus Security Advisory
Date: November 4, 2026
Affected Versions: All Sonatype Nexus Repository 3 CE/Pro versions from 3.94.0 up to, but not including, 3.98.0
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.98.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N = 6.3 (Medium)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-113369
Summary
A vulnerability in the Browse user interface of Sonatype Nexus Repository 3 allows a user that can push manifests to a hosted OCI repository (a user that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface. The script runs with the permissions of the viewing user. If the viewing user is an administrator, the script can use the administrator’s access.
At the time of this advisory, Sonatype is not aware of this vulnerability being actively exploited in the wild.
Recommendation
Users are advised to upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.98.0 or later. Downloads are available at https://help.sonatype.com/en/download.html.
The fix applies to existing content. OCI manifests that were pushed before the upgrade no longer run script when you view them after the upgrade.
Immediate Mitigation Options
There is no configuration change that fully mitigates this vulnerability without upgrading. The following measures reduce exposure:
-
Restrict the permissions: Grant the edit permission on hosted OCI repositories (
nx-repository-view-oci-*-edit, or any role that contains it) only to fully trusted users. Do not grant it to the anonymous user. - Remove unused repositories: If your instance does not need a hosted OCI repository, delete it.
- Network-level access control: Restrict access to the Nexus Repository web interface to trusted networks.
Credit
This issue was discovered and reported responsibly by Nguyen Truong Son (truongson526@gmail.com) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker can run script in the browser of a user who views the Attestations tab of an affected image in the Browse user interface. The script runs with the permissions of that user. If the user is an administrator, the attacker can perform administrative actions on the instance.
Q: What preconditions must be met in order to be vulnerable?
A: The instance must have at least one hosted OCI repository. OCI repositories are not created by default. The attacker must have network access to the Nexus Repository web interface. The attacker must hold the edit privilege on a hosted OCI repository (nx-repository-view-oci-<repository>-edit), directly or through a role. Another user must then open the Attestations tab for the related image in the Browse user interface.
Q: Are proxy and group repositories affected?
A: A group repository that has an affected hosted repository as a member shows the same data, so the same preconditions apply. A proxy repository does not list attestations by default. If an administrator runs the “OCI - Rebuild Referrers index” task on a proxy repository, attestation data from cached upstream manifests can be listed. The fix applies to hosted, proxy and group repositories.
Q: Are there implications associated with this advisory itself?
A: Publishing this advisory may enable malicious actors to attempt to exploit this vulnerability. Affected users should assess their exposure and apply the recommended upgrade or interim mitigation as soon as practicable.
Q: Why is Sonatype making this information available?
A: Sonatype follows responsible disclosure practices. We coordinate with security researchers who report vulnerabilities to us in good faith, and we publish advisories after a fix is available so that users can take informed action to protect their installations.