The vulnerability in Nexus Repository 3 arises from insufficient restrictions on the HikariCP connection-pool properties configurable via the DataStore API. Specifically, the connectionInitSql property can be set by users with the nx-datastores-update permission, allowing arbitrary SQL execution on each new database connection. This can be exploited to achieve remote code execution on the default H2 database backend, compromising the Nexus process user privileges.

An attacker with the nx-datastores-update permission can execute arbitrary SQL commands on the Nexus database. On the default H2 backend, this can escalate to remote code execution with the privileges of the Nexus process user, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the nx-datastores-update permission to trusted users only to limit exploitation potential.