Nexus Repository 3 version 3.20.0 does not sufficiently restrict which HikariCP connection-pool properties can be set through its DataStore configuration API. Specifically, a user with the nx-datastores-update permission can manipulate the connectionInitSql property, causing arbitrary SQL execution on each new database connection. On the default H2 database backend, this vulnerability can be exploited to achieve remote code execution with the privileges of the Nexus process user. This is classified as CWE-94 (Improper Control of Generation of Code) and carries a CVSS 4.0 base score of 8.7, indicating high severity. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

An attacker with the nx-datastores-update permission can execute arbitrary SQL commands on the Nexus Repository 3 database. When the default H2 database is used, this can escalate to remote code execution as the Nexus process user, potentially compromising the system hosting Nexus Repository 3. This could lead to unauthorized data access, modification, or full system compromise depending on the environment and privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict the nx-datastores-update permission to trusted users only and avoid using the default H2 database backend in production environments if possible.