CVE-2026-113369
Received Received - Intake

Stored XSS in Sonatype Nexus Repository 3

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: Sonatype

Description
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-113369
EUVD
EUVD-2026-117062

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sonatype Nexus Repository 3 3.94.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Sonatype Nexus Repository 3. It allows a user with edit permissions on a hosted OCI repository to inject malicious script content into the artifact type field of an OCI manifest. When another user views the Attestations tab for the related image, the script executes in their browser with the permissions of that user.

Detection Guidance

To detect this vulnerability, check Nexus Repository versions between 3.94.0 and 3.97.x. Review user accounts with edit permissions on hosted OCI repositories. Inspect OCI manifests for script content in the artifact type field. Monitor browser console logs for unexpected script execution when accessing the Attestations tab.

Impact Analysis

If you are an administrator viewing an affected image, the script could perform administrative actions on the Nexus Repository instance. The impact depends on the permissions of the viewing user. The vulnerability requires network access to the web interface and edit privileges on a hosted OCI repository.

Mitigation Strategies

Upgrade to Nexus Repository 3.98.0 or later. Restrict edit permissions on hosted OCI repositories to trusted users. Remove unused repositories. Limit web interface access to trusted networks. Apply these changes before upgrading if immediate mitigation is required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113369. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...