CVE-2026-17596 in Nexus Repository
Summary
by MITRE • 08/07/2026
Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified in Nexus Repository 3 represents a critical stored cross-site scripting flaw that enables attackers to inject malicious scripts into the repository's blob store names. This security weakness stems from insufficient input validation and sanitization mechanisms within the system's user interface components. The vulnerability specifically affects versions prior to 3.95.0 and demonstrates how seemingly benign administrative functions can become attack vectors when proper security controls are absent. The flaw resides in the application's handling of user-provided data during blob store creation and update operations, where script content can be persisted without adequate filtering or encoding.
The technical execution of this vulnerability occurs through a classic stored XSS attack pattern where malicious input is first stored on the server and subsequently served to other users without proper sanitization. When administrators or other users view the system health-check status page, the malicious script contained within the blob store name executes in their browser context. This allows attackers to perform actions such as stealing session cookies, redirecting users to malicious sites, or executing unauthorized operations within the repository environment. The vulnerability is particularly concerning because it requires only minimal privileges equivalent to nexus:blobstores:create or nexus:blobstores:update permissions, making it accessible to users with relatively low-level administrative access.
The operational impact of this vulnerability extends beyond simple script execution, as it can facilitate more sophisticated attacks within the repository ecosystem. An attacker who successfully exploits this flaw could potentially escalate privileges, access sensitive configuration data, or use the compromised session to perform unauthorized operations on the repository. The attack vector is particularly dangerous in enterprise environments where Nexus Repository serves as a critical component for managing software artifacts and dependencies. The stored nature of the vulnerability means that once an attacker successfully injects malicious content, it will continue to affect all users who view the affected status page until the malicious content is removed or the system is updated.
Organizations should prioritize immediate remediation by upgrading to Nexus Repository version 3.95.0 or later, which implements proper input sanitization and output encoding mechanisms. Security teams should also conduct thorough audits of existing blob store names to identify any potentially compromised entries and implement additional monitoring for suspicious administrative activities. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, and it maps to attack techniques within the ATT&CK framework under T1059.001 for command and script injection. Organizations should also consider implementing web application firewalls and additional input validation measures as defensive controls to mitigate similar risks in other applications within their environment.