Read the docs
TI-2026-74834 Aliases CVE-2026-97667

Stored cross-site scripting in Sonatype Nexus Repository 3 Browse UI

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Sonatype Nexus Repository 3 from 3.28.0 before 3.97.0 contains a stored cross-site scripting flaw (CWE-79) in the Browse user interface. A user account with edit permission on a hosted R repository can store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package, with that viewer's permissions.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed Nexus Repository 3 (Sonatype): 3.97.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SonatypeNexus Repository 33.28.0 to before 3.97.03.97.0Patch availableCNA
  • Nexus Repository 3 VendorSonatype Affected 3.28.0 to before 3.97.0 Fixed in 3.97.0 Patch available CNA

CPE names CNA · 135

CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.28.0:*:*:*:*:*:*:*3.28.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.28.1:*:*:*:*:*:*:*3.28.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.29.0:*:*:*:*:*:*:*3.29.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.29.1:*:*:*:*:*:*:*3.29.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.29.2:*:*:*:*:*:*:*3.29.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.30.0:*:*:*:*:*:*:*3.30.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.30.1:*:*:*:*:*:*:*3.30.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.31.0:*:*:*:*:*:*:*3.31.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.31.1:*:*:*:*:*:*:*3.31.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.32.0:*:*:*:*:*:*:*3.32.0—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.28.0:*:*:*:*:*:*:* Versions 3.28.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.28.1:*:*:*:*:*:*:* Versions 3.28.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.29.0:*:*:*:*:*:*:* Versions 3.29.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.29.1:*:*:*:*:*:*:* Versions 3.29.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.29.2:*:*:*:*:*:*:* Versions 3.29.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.30.0:*:*:*:*:*:*:* Versions 3.30.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.30.1:*:*:*:*:*:*:* Versions 3.30.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.31.0:*:*:*:*:*:*:* Versions 3.31.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.31.1:*:*:*:*:*:*:* Versions 3.31.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.32.0:*:*:*:*:*:*:* Versions 3.32.0 — ·Sonatype
Show 125 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.32.1:*:*:*:*:*:*:*3.32.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.33.0:*:*:*:*:*:*:*3.33.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.33.1:*:*:*:*:*:*:*3.33.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.34.0:*:*:*:*:*:*:*3.34.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.34.1:*:*:*:*:*:*:*3.34.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.35.0:*:*:*:*:*:*:*3.35.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.36.0:*:*:*:*:*:*:*3.36.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.37.0:*:*:*:*:*:*:*3.37.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.37.1:*:*:*:*:*:*:*3.37.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.37.2:*:*:*:*:*:*:*3.37.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.37.3:*:*:*:*:*:*:*3.37.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.38.0:*:*:*:*:*:*:*3.38.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.38.1:*:*:*:*:*:*:*3.38.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.39.0:*:*:*:*:*:*:*3.39.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.40.0:*:*:*:*:*:*:*3.40.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.40.1:*:*:*:*:*:*:*3.40.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.41.0:*:*:*:*:*:*:*3.41.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.41.1:*:*:*:*:*:*:*3.41.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.42.0:*:*:*:*:*:*:*3.42.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.43.0:*:*:*:*:*:*:*3.43.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.44.0:*:*:*:*:*:*:*3.44.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.45.0:*:*:*:*:*:*:*3.45.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.45.1:*:*:*:*:*:*:*3.45.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.46.0:*:*:*:*:*:*:*3.46.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.47.0:*:*:*:*:*:*:*3.47.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.47.1:*:*:*:*:*:*:*3.47.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.48.0:*:*:*:*:*:*:*3.48.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.49.0:*:*:*:*:*:*:*3.49.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.50.0:*:*:*:*:*:*:*3.50.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.51.0:*:*:*:*:*:*:*3.51.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.52.0:*:*:*:*:*:*:*3.52.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.53.0:*:*:*:*:*:*:*3.53.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.53.1:*:*:*:*:*:*:*3.53.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.54.0:*:*:*:*:*:*:*3.54.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.54.1:*:*:*:*:*:*:*3.54.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.55.0:*:*:*:*:*:*:*3.55.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.56.0:*:*:*:*:*:*:*3.56.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.57.0:*:*:*:*:*:*:*3.57.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.57.1:*:*:*:*:*:*:*3.57.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.58.0:*:*:*:*:*:*:*3.58.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.58.1:*:*:*:*:*:*:*3.58.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.59.0:*:*:*:*:*:*:*3.59.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.60.0:*:*:*:*:*:*:*3.60.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.61.0:*:*:*:*:*:*:*3.61.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.62.0:*:*:*:*:*:*:*3.62.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.63.0:*:*:*:*:*:*:*3.63.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.64.0:*:*:*:*:*:*:*3.64.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.65.0:*:*:*:*:*:*:*3.65.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.66.0:*:*:*:*:*:*:*3.66.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.67.0:*:*:*:*:*:*:*3.67.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.67.1:*:*:*:*:*:*:*3.67.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.68.0:*:*:*:*:*:*:*3.68.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.68.1:*:*:*:*:*:*:*3.68.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.69.0:*:*:*:*:*:*:*3.69.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.70.0:*:*:*:*:*:*:*3.70.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.70.1:*:*:*:*:*:*:*3.70.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.71.0:*:*:*:*:*:*:*3.71.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.72.0:*:*:*:*:*:*:*3.72.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.73.0:*:*:*:*:*:*:*3.73.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.74.0:*:*:*:*:*:*:*3.74.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.75.0:*:*:*:*:*:*:*3.75.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.75.1:*:*:*:*:*:*:*3.75.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.76.0:*:*:*:*:*:*:*3.76.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.76.1:*:*:*:*:*:*:*3.76.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.77.0:*:*:*:*:*:*:*3.77.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.77.1:*:*:*:*:*:*:*3.77.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.77.2:*:*:*:*:*:*:*3.77.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.78.0:*:*:*:*:*:*:*3.78.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.78.1:*:*:*:*:*:*:*3.78.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.78.2:*:*:*:*:*:*:*3.78.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.78.3:*:*:*:*:*:*:*3.78.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.79.0:*:*:*:*:*:*:*3.79.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.79.1:*:*:*:*:*:*:*3.79.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.80.0:*:*:*:*:*:*:*3.80.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.81.0:*:*:*:*:*:*:*3.81.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.81.1:*:*:*:*:*:*:*3.81.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.82.0:*:*:*:*:*:*:*3.82.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.82.1:*:*:*:*:*:*:*3.82.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.83.0:*:*:*:*:*:*:*3.83.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.83.1:*:*:*:*:*:*:*3.83.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.83.2:*:*:*:*:*:*:*3.83.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.84.0:*:*:*:*:*:*:*3.84.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.84.1:*:*:*:*:*:*:*3.84.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.84.2:*:*:*:*:*:*:*3.84.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.85.0:*:*:*:*:*:*:*3.85.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.85.1:*:*:*:*:*:*:*3.85.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:*3.86.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.86.1:*:*:*:*:*:*:*3.86.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:*3.86.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.86.3:*:*:*:*:*:*:*3.86.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:*3.87.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:*3.87.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.87.2:*:*:*:*:*:*:*3.87.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:*3.88.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.88.1:*:*:*:*:*:*:*3.88.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.89.0:*:*:*:*:*:*:*3.89.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.89.1:*:*:*:*:*:*:*3.89.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:*3.90.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:*3.90.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:*3.90.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:*3.90.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:*3.90.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:*3.90.5—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:*3.91.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:*3.91.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:*3.92.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:*3.92.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:*3.92.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:*3.92.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:*3.93.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:*3.93.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:*3.93.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*3.94.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*3.94.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*3.94.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*3.95.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*3.95.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*3.95.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*3.95.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*3.95.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*3.96.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*3.96.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*3.96.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*3.96.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*3.96.4—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.32.1:*:*:*:*:*:*:* Versions 3.32.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.33.0:*:*:*:*:*:*:* Versions 3.33.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.33.1:*:*:*:*:*:*:* Versions 3.33.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.34.0:*:*:*:*:*:*:* Versions 3.34.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.34.1:*:*:*:*:*:*:* Versions 3.34.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.35.0:*:*:*:*:*:*:* Versions 3.35.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.36.0:*:*:*:*:*:*:* Versions 3.36.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.37.0:*:*:*:*:*:*:* Versions 3.37.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.37.1:*:*:*:*:*:*:* Versions 3.37.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.37.2:*:*:*:*:*:*:* Versions 3.37.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.37.3:*:*:*:*:*:*:* Versions 3.37.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.38.0:*:*:*:*:*:*:* Versions 3.38.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.38.1:*:*:*:*:*:*:* Versions 3.38.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.39.0:*:*:*:*:*:*:* Versions 3.39.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.40.0:*:*:*:*:*:*:* Versions 3.40.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.40.1:*:*:*:*:*:*:* Versions 3.40.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.41.0:*:*:*:*:*:*:* Versions 3.41.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.41.1:*:*:*:*:*:*:* Versions 3.41.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.42.0:*:*:*:*:*:*:* Versions 3.42.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.43.0:*:*:*:*:*:*:* Versions 3.43.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.44.0:*:*:*:*:*:*:* Versions 3.44.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.45.0:*:*:*:*:*:*:* Versions 3.45.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.45.1:*:*:*:*:*:*:* Versions 3.45.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.46.0:*:*:*:*:*:*:* Versions 3.46.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.47.0:*:*:*:*:*:*:* Versions 3.47.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.47.1:*:*:*:*:*:*:* Versions 3.47.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.48.0:*:*:*:*:*:*:* Versions 3.48.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.49.0:*:*:*:*:*:*:* Versions 3.49.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.50.0:*:*:*:*:*:*:* Versions 3.50.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.51.0:*:*:*:*:*:*:* Versions 3.51.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.52.0:*:*:*:*:*:*:* Versions 3.52.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.53.0:*:*:*:*:*:*:* Versions 3.53.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.53.1:*:*:*:*:*:*:* Versions 3.53.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.54.0:*:*:*:*:*:*:* Versions 3.54.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.54.1:*:*:*:*:*:*:* Versions 3.54.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.55.0:*:*:*:*:*:*:* Versions 3.55.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.56.0:*:*:*:*:*:*:* Versions 3.56.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.57.0:*:*:*:*:*:*:* Versions 3.57.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.57.1:*:*:*:*:*:*:* Versions 3.57.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.58.0:*:*:*:*:*:*:* Versions 3.58.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.58.1:*:*:*:*:*:*:* Versions 3.58.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.59.0:*:*:*:*:*:*:* Versions 3.59.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.60.0:*:*:*:*:*:*:* Versions 3.60.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.61.0:*:*:*:*:*:*:* Versions 3.61.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.62.0:*:*:*:*:*:*:* Versions 3.62.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.63.0:*:*:*:*:*:*:* Versions 3.63.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.64.0:*:*:*:*:*:*:* Versions 3.64.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.65.0:*:*:*:*:*:*:* Versions 3.65.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.66.0:*:*:*:*:*:*:* Versions 3.66.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.67.0:*:*:*:*:*:*:* Versions 3.67.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.67.1:*:*:*:*:*:*:* Versions 3.67.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.68.0:*:*:*:*:*:*:* Versions 3.68.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.68.1:*:*:*:*:*:*:* Versions 3.68.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.69.0:*:*:*:*:*:*:* Versions 3.69.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.70.0:*:*:*:*:*:*:* Versions 3.70.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.70.1:*:*:*:*:*:*:* Versions 3.70.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.71.0:*:*:*:*:*:*:* Versions 3.71.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.72.0:*:*:*:*:*:*:* Versions 3.72.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.73.0:*:*:*:*:*:*:* Versions 3.73.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.74.0:*:*:*:*:*:*:* Versions 3.74.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.75.0:*:*:*:*:*:*:* Versions 3.75.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.75.1:*:*:*:*:*:*:* Versions 3.75.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.76.0:*:*:*:*:*:*:* Versions 3.76.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.76.1:*:*:*:*:*:*:* Versions 3.76.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.77.0:*:*:*:*:*:*:* Versions 3.77.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.77.1:*:*:*:*:*:*:* Versions 3.77.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.77.2:*:*:*:*:*:*:* Versions 3.77.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.78.0:*:*:*:*:*:*:* Versions 3.78.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.78.1:*:*:*:*:*:*:* Versions 3.78.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.78.2:*:*:*:*:*:*:* Versions 3.78.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.78.3:*:*:*:*:*:*:* Versions 3.78.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.79.0:*:*:*:*:*:*:* Versions 3.79.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.79.1:*:*:*:*:*:*:* Versions 3.79.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.80.0:*:*:*:*:*:*:* Versions 3.80.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.81.0:*:*:*:*:*:*:* Versions 3.81.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.81.1:*:*:*:*:*:*:* Versions 3.81.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.82.0:*:*:*:*:*:*:* Versions 3.82.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.82.1:*:*:*:*:*:*:* Versions 3.82.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.83.0:*:*:*:*:*:*:* Versions 3.83.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.83.1:*:*:*:*:*:*:* Versions 3.83.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.83.2:*:*:*:*:*:*:* Versions 3.83.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.84.0:*:*:*:*:*:*:* Versions 3.84.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.84.1:*:*:*:*:*:*:* Versions 3.84.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.84.2:*:*:*:*:*:*:* Versions 3.84.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.85.0:*:*:*:*:*:*:* Versions 3.85.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.85.1:*:*:*:*:*:*:* Versions 3.85.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:* Versions 3.86.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.86.1:*:*:*:*:*:*:* Versions 3.86.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:* Versions 3.86.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.86.3:*:*:*:*:*:*:* Versions 3.86.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:* Versions 3.87.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:* Versions 3.87.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.87.2:*:*:*:*:*:*:* Versions 3.87.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.88.0:*:*:*:*:*:*:* Versions 3.88.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.88.1:*:*:*:*:*:*:* Versions 3.88.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.89.0:*:*:*:*:*:*:* Versions 3.89.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.89.1:*:*:*:*:*:*:* Versions 3.89.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.0:*:*:*:*:*:*:* Versions 3.90.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.1:*:*:*:*:*:*:* Versions 3.90.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.2:*:*:*:*:*:*:* Versions 3.90.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.3:*:*:*:*:*:*:* Versions 3.90.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.4:*:*:*:*:*:*:* Versions 3.90.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.90.5:*:*:*:*:*:*:* Versions 3.90.5 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0:*:*:*:*:*:*:* Versions 3.91.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1:*:*:*:*:*:*:* Versions 3.91.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.92.0:*:*:*:*:*:*:* Versions 3.92.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1:*:*:*:*:*:*:* Versions 3.92.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2:*:*:*:*:*:*:* Versions 3.92.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3:*:*:*:*:*:*:* Versions 3.92.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0:*:*:*:*:*:*:* Versions 3.93.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1:*:*:*:*:*:*:* Versions 3.93.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2:*:*:*:*:*:*:* Versions 3.93.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:* Versions 3.94.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:* Versions 3.94.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:* Versions 3.94.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:* Versions 3.95.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:* Versions 3.95.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:* Versions 3.95.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:* Versions 3.95.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:* Versions 3.95.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:* Versions 3.96.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:* Versions 3.96.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:* Versions 3.96.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:* Versions 3.96.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:* Versions 3.96.4 — ·Sonatype

Remediation

Upgrade Sonatype Nexus Repository 3 to version 3.97.0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Nexus Repository 3 (Sonatype) Fixed in 3.97.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sonatype Nexus Repository 3 3.97.0

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-74835 Sonatype Nexus Repository 3 lets users escalate privileges via rolesPriority LOW 39
    • TI-2026-74833 Unsafe reflection in Sonatype Nexus Repository 3 ExtDirect endpointPriority LOW 37
    • TI-2026-74832 Missing authorization in Nexus Repository 3 NuGet symbol package uploadPriority LOW 31
    Show all 4 records →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-97667

References

Patch 1

Advisory 1

  • TI-2019-05133 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-08218 Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). KEVCVSS 3.1HIGH 8.8
  • TI-2020-08220 Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. CVSS 3.1HIGH 7.2
  • TI-2024-04604 Nexus Repository 3 - Path Traversal CVSS 3.1HIGH 7.5
  • TI-2019-03883 OS command injection in Nexus Repository Manager CVSS 3.0HIGH 8.8
  • TI-2026-02763 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVSS 4.0CRITICAL 9.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences