This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Sonatype Nexus Repository fixes 2 vulnerabilities

Sonatype fixes 2 vulnerabilities in Nexus Repository 3 with version 3.91.0 [1][2].

Sonatype Nexus Repository - RCE (CVE-2026-3199)
CVSS 9.4 (Critical)

Allows an authenticated remote attacker, due to insufficient permission checks in the task management component, to bypass restrictions on running administrator scripts, execute arbitrary code and fully compromise the server and its contents [1][3].

The vulnerability is present in product:

  • Sonatype Nexus Repository; >=3.22.1, <3.91.0

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L

More information:

The vulnerability was publicly disclosed 8. 4. 2026.

Sonatype Nexus Repository - XSS (CVE-2026-3438)
CVSS 5.1 (Medium)

Allows an unauthenticated remote attacker, due to a reflected XSS vulnerability, to inject arbitrary HTML content into the victim's browser after tricking the victim into visiting a forged URL, while sandbox restrictions (CSP) prevent access to session cookies and other Nexus Repository resources [2][4].

The vulnerability is present in product:

  • Sonatype Nexus Repository; >=3.0.0, <3.91.0

CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

More information:

  • CVE-2026-3438 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 4. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 9. 4. 2026.

CESNET, z.s.p.o. Logo