CVE-2026-113369 in Nexus Repository
Summary
by MITRE • 11/04/2026
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified involves a Cross-Site Scripting (XSS) flaw within Sonatype Nexus Repository 3, specifically affecting its handling of Open Container Initiative (OCI) artifacts and their associated metadata. This security issue arises from an insufficient validation mechanism when processing OCI manifests pushed by users with edit permissions on hosted repositories. An attacker possessing the necessary write access to a repository can manipulate the artifact type field within an OCI manifest to inject malicious script content rather than providing standard, expected data types. The system fails to sanitize or properly encode this input before storing it in its database and subsequently rendering it back to clients through the web interface.
The operational impact of this vulnerability is significant because it allows for stored cross-site scripting attacks that are triggered by legitimate administrative actions within the application's user interface. When a victim with appropriate viewing permissions navigates to the Attestations tab for an image containing the maliciously crafted manifest, the browser executes the injected script content in the context of the victim’s session. This execution occurs under the security privileges of the viewing user, which typically includes administrative or high-level access rights within the Nexus Repository environment. Consequently, this can lead to unauthorized data exfiltration, session hijacking, credential theft, or complete compromise of the repository management infrastructure if the viewer holds elevated permissions.
From a technical perspective, this flaw represents a classic case of improper input validation and output encoding failure. The application accepts user-supplied content in the artifact type field without verifying that it conforms to expected alphanumeric or standard identifier formats. Instead of treating the field as plain text requiring HTML entity encoding before display, the system treats it as potentially executable code when rendered within the Attestations tab view. This behavior violates fundamental web security principles regarding the separation of data and code, allowing an attacker to inject client-side scripts that bypass same-origin policy protections due to their origin from a trusted domain.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It also maps to the MITRE ATT&CK framework under techniques such as T1059 Command and Scripting Interpretation for the execution aspect and potentially T1204 User Execution if it requires user interaction, though in this case, the interaction is limited to viewing a specific tab rather than clicking an external link. The attack vector relies on social engineering or insider threats where an attacker with write access plants the payload, waiting for another privileged user to inspect the affected image’s attestations.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Administrators must apply vendor-provided patches that address this specific flaw in Sonatype Nexus Repository 3 as soon as they become available. In environments where patching is delayed, implementing a Web Application Firewall (WAF) with rules designed to detect and block script injection patterns within OCI manifest fields can provide temporary protection. Furthermore, enforcing strict least-privilege access controls ensures that fewer users have the ability to push manifests or view sensitive attestation data, thereby reducing the attack surface. Developers should also implement rigorous input validation on all user-supplied fields in API endpoints handling OCI artifacts and ensure consistent output encoding across all UI components that display repository metadata.