CVE-2026-97667: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Sonatype Nexus Repository 3

Sonatype Nexus Repository 3 contains a CWE-79 improper neutralization of input vulnerability that allows stored cross-site scripting via metadata in R packages. A user with edit permission on a hosted R repository can embed malicious script content in the package metadata. When other users view the package details in the Browse UI, the script executes in their browsers with their privileges. This affects versions >=3.28.0 and <3.97.0. The vulnerability requires user interaction and privileges to edit packages, and the anonymous user can be affected if granted permissions. No known exploits in the wild or vendor patch information is provided.

Successful exploitation allows script execution in the context of the victim user's browser with their permissions in Nexus Repository 3. This can lead to unauthorized actions performed on behalf of the user, data theft, or session hijacking within the application. The impact is limited by the requirement that the attacker must have edit permission on a hosted R repository and that the victim must view the malicious package details. The vulnerability does not affect confidentiality, integrity, or availability directly but poses a risk of privilege abuse and user session compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict edit permissions on hosted R repositories to trusted users only. Disable anonymous access or ensure it does not have edit permissions. Monitor for suspicious package metadata and avoid opening package details from untrusted sources.