CVE-2026-97667

Sonatype Nexus Repository 3 is vulnerable to Stored Cross-Site Scripting (XSS) in its Browse UI. An account with edit permissions on a hosted R repository can inject script content into the metadata of an uploaded R package. When another user views the package details in the Browse UI, the script...

CVE-2026-97667 Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the...