Read the docs
TI-2026-00402 Aliases CVE-2026-0601GHSA-7j27-hv22-fqgw

Nexus Repository 3 - Cross-Site Scripting

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00427 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SonatypeNexus Repository3.82.0 – 3.87.1—No fix listedCNA
  • Nexus Repository VendorSonatype Affected 3.82.0 – 3.87.1 Fixed in — No fix listed CNA

CPE names CNA · 11

CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.82.0:*:*:*:*:*:*:*3.82.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.83.0:*:*:*:*:*:*:*3.83.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.83.1:*:*:*:*:*:*:*3.83.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.83.2:*:*:*:*:*:*:*3.83.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.84.0:*:*:*:*:*:*:*3.84.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.84.1:*:*:*:*:*:*:*3.84.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.85.0:*:*:*:*:*:*:*3.85.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:*3.86.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:*3.86.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:*3.87.0—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.82.0:*:*:*:*:*:*:* Versions 3.82.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.83.0:*:*:*:*:*:*:* Versions 3.83.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.83.1:*:*:*:*:*:*:* Versions 3.83.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.83.2:*:*:*:*:*:*:* Versions 3.83.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.84.0:*:*:*:*:*:*:* Versions 3.84.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.84.1:*:*:*:*:*:*:* Versions 3.84.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.85.0:*:*:*:*:*:*:* Versions 3.85.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:* Versions 3.86.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:* Versions 3.86.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:* Versions 3.87.0 — ·Sonatype
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:*3.87.1—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:* Versions 3.87.1 — ·Sonatype

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-0601
  2. 2026-10-03 Alias added: GHSA-7j27-hv22-fqgw

References

Patch 1

Advisory 1

  • TI-2019-05133 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-08218 Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). KEVCVSS 3.1HIGH 8.8
  • TI-2020-08220 Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. CVSS 3.1HIGH 7.2
  • TI-2024-04604 Nexus Repository 3 - Path Traversal CVSS 3.1HIGH 7.5
  • TI-2019-03883 OS command injection in Nexus Repository Manager CVSS 3.0HIGH 8.8
  • TI-2026-02763 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVSS 4.0CRITICAL 9.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences