Nexus Repository 3 contains a vulnerability where insufficient restrictions on HikariCP connection-pool properties allow a user with nx-datastores-update permission to set the connectionInitSql property. This enables execution of arbitrary SQL on every new database connection. When using the default H2 database backend, this flaw can lead to remote code execution as the Nexus process user.