CVE-2026-97667— Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
Quick assessment
Affected
Sonatype Nexus Repository 3
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sonatype Nexus Repository 3 存在一处安全漏洞，允许拥有托管 R 仓库编辑权限的用户账户，在上传的 R 包元数据中存储脚本内容。当其他用户在“浏览”用户界面中查看该包的详细信息时，这些脚本将在其浏览器中执行，并以查看用户的权限运行。在本描述中，“用户账户”指已成功提供有效凭据的账户。如果启用了匿名用户功能，则该匿名用户也视为一个用户账户；若管理员赋予其相应权限，它也可拥有上述编辑权限。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.28.0< 3.97.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97667
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
Source: CVE Program / CVE List V5
Vulnerability Description
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user. In this description, a user account means an account that has supplied valid credentials. The anonymous user, if enabled, is also a user account and can hold this permission if an administrator grants it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Sonatype | Nexus Repository 3 | 3.28.0 ~ 3.97.0 |
cpe:2.3:a:sonatype:nexus_repository_manager:3.28.0:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-97667
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97667
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-97667 (1)
Vendor Pages for CVE-2026-97667 (1)
Same Patch Batch · Sonatype · 2026-10-15 · 4 CVEs total
| CVE-2026-97712 | 8.7 HIGH | Nexus Repository 3 - Privilege Escalation via Role Management |
| CVE-2026-97665 | 7.1 HIGH | Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload |
| CVE-2026-97666 | 6.9 MEDIUM | Nexus Repository 3 - Unsafe Reflection in ExtDirect Repository Endpoint |
IV. Related Vulnerabilities
Same product: Nexus Repository 3
-
CVE-2026-97712
Nexus Repository 3 - Privilege Escalation via Role Managemen -
CVE-2026-97665
Nexus Repository 3 - Missing Authorization on NuGet Symbol P -
CVE-2026-97666
Nexus Repository 3 - Unsafe Reflection in ExtDirect Reposito -
CVE-2026-77123
Nexus Repository 3 - Webhook Secret Disclosure via Capabilit -
CVE-2026-77124
Nexus Repository 3 - Script Execution Disable Setting Not En
Same vendor: Sonatype
-
CVE-2026-97712
Nexus Repository 3 - Privilege Escalation via Role Managemen -
CVE-2026-97665
Nexus Repository 3 - Missing Authorization on NuGet Symbol P -
CVE-2026-97666
Nexus Repository 3 - Unsafe Reflection in ExtDirect Reposito -
CVE-2026-77123
Nexus Repository 3 - Webhook Secret Disclosure via Capabilit -
CVE-2026-77124
Nexus Repository 3 - Script Execution Disable Setting Not En
Same weakness: CWE-79
-
CVE-2026-100186
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross -
CVE-2026-88963
Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected D -
CVE-2026-109513
NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site S -
CVE-2026-111122
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based C -
CVE-2026-107764
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based C
V. Comments for CVE-2026-97667
No comments yet