CVE-2026-97667
Received Received - Intake

Stored Script Injection in Sonatype Nexus Repository 3

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Sonatype

Description
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-97667
EUVD
EUVD-2026-102154

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sonatype Nexus Repository 3 3.28.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Sonatype Nexus Repository 3. A user with edit permissions on a hosted R repository can inject malicious script into an R package's metadata. When another user views the package details in the Browse UI, the script runs in their browser with the viewer's permissions.

Detection Guidance

To detect this vulnerability, check for R packages in Nexus Repository 3 with suspicious script content in their metadata. Review user accounts with edit permissions on hosted R repositories. Inspect browser console logs for unexpected script execution when viewing package details.

Impact Analysis

If you are an administrator viewing a malicious package, the script could perform administrative actions on your Nexus Repository instance. Regular users might experience unauthorized actions or data exposure depending on their permissions.

Mitigation Strategies

Upgrade to Nexus Repository 3.97.0 or later. Restrict edit permissions on hosted R repositories to trusted users only. Disable edit permissions for anonymous users. Remove unused R repositories. Limit web interface access to trusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97667. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart