CVE-2026-1133696.3Medium
CVE-2026-113369: Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab
Sonatype · Nexus Repository 3
Vendor fix available · Affected: Sonatype Nexus Repository 3 · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.2%probability of exploitation in the next 30 days
15th percentile
050100
Higher than 15% of scored CVEs
6.3MediumCVSS
LowMediumHighCrit.
DescriptionNVD
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 6 Nov.
- Sonatype fixes seven Nexus Repository flaws enabling SSO bypass and privilege escalationSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.