This vulnerability (CWE-502) affects the task management component of Sonatype Nexus Repository versions 3.22.1 through 3.90.2. An authenticated user with permission to create tasks can exploit improper deserialization of untrusted data to execute arbitrary code, bypassing the nexus.scripts.allowCreation security control. The CVSS 4.0 score of 9.4 reflects a critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements. The vendor has not yet provided an official fix or detailed remediation instructions. The product is not a cloud service, so remediation depends on vendor patch availability.

Successful exploitation allows an authenticated attacker with task creation privileges to execute arbitrary code on the Nexus Repository server. This can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability of the repository and potentially other connected systems. The vulnerability bypasses existing security controls designed to restrict script creation, increasing the risk of unauthorized code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict task creation permissions to trusted users only and monitor for suspicious activity related to task management. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.