Sonatype Nexus Repository 3 version 3.15.0 contained a vulnerability (CVE-2026-17595) due to incomplete sandboxing of JEXL expressions in Content Selectors. An attacker with nexus:selectors:create permission could craft expressions that accessed Java object properties not meant to be exposed, disclosing internal JVM metadata like class and classloader names. The vulnerability is limited to information disclosure and does not permit code execution or object manipulation. The fix involved restricting property access within the JEXL sandbox to only intended data types.

An attacker with limited privileges (nexus:selectors:create) could gain unauthorized access to sensitive JVM internal metadata, potentially aiding further attacks or reconnaissance. However, the vulnerability does not allow execution of arbitrary code or modification of objects, limiting the impact to information disclosure only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated the issue is fixed by restricting property access in the JEXL sandbox, but no official patch or remediation level is provided in the available data. Users should monitor Sonatype advisories for updates and apply official fixes once available.