This vulnerability (CVE-2026-7308) involves improper neutralization of input during web page generation (CWE-79) in Sonatype Nexus Repository. Specifically, authenticated users with upload permissions can inject malicious content that executes arbitrary JavaScript when other users browse the affected repository's HTML index page. This can lead to session-based attacks where the attacker can perform actions as the victim user. The issue affects Nexus Repository versions from 3.6.0 up to but not including 3.92.0. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond upload permission, user interaction required, and limited scope and impact. No official remediation level or patch links are currently available.

An attacker with authenticated upload permissions can inject malicious scripts that execute in the browsers of users viewing the repository directory index page. This could allow the attacker to perform actions on behalf of the victim user within their session context. The impact is limited to users who browse the affected repository directories and have the necessary permissions to upload content. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict upload permissions to trusted users only and consider limiting access to the repository directory browsing feature. Monitor vendor communications for updates on patches or official mitigations.