Threats affecting pkg:maven/org.sonatype.nexus/nexus-repository

An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript to execute in the browser of any user who browses that repository directory via the HTML index page in Sonatype Nexus Repository versions 3.6.0 through versions before 3.92.0. This could allow the attacker to perform actions in the context of the victim's session.

CVE-2026-5189 is a critical vulnerability in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 involving the use of hard-coded credentials. An unauthenticated attacker with network access can exploit this issue if the non-default configuration nexus.orient.binaryListenerEnabled=true is enabled. Successful exploitation allows unauthorized read/write access to the internal database and execution of arbitrary OS commands as the Nexus process user. The vulnerability has a CVSS 4.

CVE-2026-3199 is a critical vulnerability in Sonatype Nexus Repository versions 3.22.1 through 3.90.2. It affects the task management component, allowing an authenticated attacker with task creation permissions to execute arbitrary code by bypassing the nexus.scripts.allowCreation security control. The vulnerability is related to deserialization of untrusted data (CWE-502). The CVSS 4.

CVE-2026-3438 is a reflected cross-site scripting (XSS) vulnerability in Sonatype Nexus Repository versions 3.0.0 through 3.90.2. It allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a specially crafted URL. Exploitation requires user interaction. The vulnerability has a medium severity with a CVSS score of 5.1. No official patch or remediation guidance is currently provided by the vendor.

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenticated administrators to configure proxy repositories with URLs that can access unintended network destinations, potentially including cloud metadata services and internal network resources. A workaround configuration is available starting in version 3.88.0, but the product remains vulnerable by default.

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.

Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.