This vulnerability in Sonatype Nexus Repository arises from unsafe deserialization in the task management component. An attacker who is authenticated and has permissions to create tasks can exploit this flaw to execute arbitrary code, circumventing the nexus.scripts.allowCreation security control designed to restrict script creation. The issue affects versions from 3.22.1 through 3.90.2. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, availability, and security controls. The vendor has not yet provided an official fix or remediation level, and the product is not a cloud service, so remediation depends on vendor updates or workarounds.

Successful exploitation allows an authenticated user with task creation permissions to execute arbitrary code on the Nexus Repository server, potentially leading to full compromise of the affected system. This bypasses existing security controls intended to restrict script creation, increasing the risk of unauthorized actions and system manipulation. The critical CVSS score reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict task creation permissions to trusted users only and monitor for suspicious activity related to task creation. No vendor-provided temporary or official fix is currently available. Follow Sonatype's advisories closely for updates.