CVE-2026-97667
Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.
| CWE | CWE-79 |
| Vendor | sonatype |
| Product | nexus repository 3 |
| Published | Oct 15, 2026 |
| Last Updated | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for sonatype nexus repository 3
Be the first to know when new unknown vulnerabilities affecting sonatype nexus repository 3 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Sonatype / Nexus Repository 3
3.28.0 < 3.97.0
References
Credits
Uttam Sabhadiya