Read the docs
TI-2026-85145 Aliases CVE-2026-113369GHSA-cjj9-qvgx-24vv

Stored cross-site scripting in Sonatype Nexus Repository 3 OCI attestations

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Sonatype Nexus Repository 3 from 3.94.0 before 3.98.0 contains a stored cross-site scripting flaw in the Attestations tab for OCI images. A user with push and edit permission on a hosted OCI repository can store script content in the artifact type field of an OCI manifest, a weakness classified as CWE-79. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse interface, with that viewing user's permissions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.

Why it matters now

EPSS 0.00243 15th percentileScored 2026-11-07
Fix Fixed Nexus Repository 3 (Sonatype): 3.98.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SonatypeNexus Repository 33.94.0 to before 3.98.03.98.0Patch availableCNA
  • Nexus Repository 3 VendorSonatype Affected 3.94.0 to before 3.98.0 Fixed in 3.98.0 Patch available CNA

CPE names CNA · 15

CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:*3.94.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:*3.94.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:*3.94.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:*3.95.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:*3.95.1—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:*3.95.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:*3.95.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:*3.95.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:*3.96.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:*3.96.1—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0:*:*:*:*:*:*:* Versions 3.94.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.1:*:*:*:*:*:*:* Versions 3.94.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.94.2:*:*:*:*:*:*:* Versions 3.94.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.0:*:*:*:*:*:*:* Versions 3.95.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.1:*:*:*:*:*:*:* Versions 3.95.1 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.2:*:*:*:*:*:*:* Versions 3.95.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.3:*:*:*:*:*:*:* Versions 3.95.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.95.4:*:*:*:*:*:*:* Versions 3.95.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.0:*:*:*:*:*:*:* Versions 3.96.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.1:*:*:*:*:*:*:* Versions 3.96.1 — ·Sonatype
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:*3.96.2—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:*3.96.3—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:*3.96.4—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:*3.97.0—Sonatype
cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:*3.97.1—Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.2:*:*:*:*:*:*:* Versions 3.96.2 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.3:*:*:*:*:*:*:* Versions 3.96.3 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.96.4:*:*:*:*:*:*:* Versions 3.96.4 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.97.0:*:*:*:*:*:*:* Versions 3.97.0 — ·Sonatype
  • cpe:2.3:a:sonatype:nexus_repository_manager:3.97.1:*:*:*:*:*:*:* Versions 3.97.1 — ·Sonatype

Remediation

Upgrade Sonatype Nexus Repository 3 to version 3.98.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Nexus Repository 3 (Sonatype) Fixed in 3.98.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sonatype Nexus Repository 3 3.98.0

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-85149 Disabled Nexus Repository 3 accounts can sign in through single sign-onPriority LOW 39
    • TI-2026-85150 Privilege escalation in Nexus Repository 3 via Rut Auth capabilityPriority LOW 37
    • TI-2026-85146 SQL injection in Nexus Repository 3 reindex search taskPriority LOW 33
    Show all 7 records →

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-113369
  2. 2026-11-04 Alias added: GHSA-cjj9-qvgx-24vv
  3. 2026-11-06 Priority changed: MEDIUM → LOW

References

Patch 1

Advisory 1

  • TI-2019-05133 Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-08218 Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2). KEVCVSS 3.1HIGH 8.8
  • TI-2020-08220 Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution. CVSS 3.1HIGH 7.2
  • TI-2024-04604 Nexus Repository 3 - Path Traversal CVSS 3.1HIGH 7.5
  • TI-2019-03883 OS command injection in Nexus Repository Manager CVSS 3.0HIGH 8.8
  • TI-2026-02763 Nexus Repository 3 - Authenticated Remote Code Execution via Task Property Injection CVSS 4.0CRITICAL 9.4
See all 90 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences