CVE-2026-113369

UNKNOWN 0.0

Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.

CWE	CWE-79
Vendor	sonatype
Product	nexus repository 3
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for sonatype nexus repository 3

Be the first to know when new unknown vulnerabilities affecting sonatype nexus repository 3 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Sonatype / Nexus Repository 3

3.94.0 < 3.98.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

help.sonatype.com: https://help.sonatype.com/en/sonatype-nexus-repository-3-98-0-release-notes.html support.sonatype.com: https://support.sonatype.com/hc/en-us/articles/56597339691027/

Credits

Nguyen Truong Son ([email protected])