CVE-2026-113369: Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.
Event History
Frequently Asked Questions
Which users could exploit this issue?
Any account with permission to push manifests to a hosted OCI repository can exploit it. The required repository-level privilege is the edit permission on that hosted OCI repository.
Which users are exposed to the stored payload?
Users who open the Attestations tab for the affected image in the Browse interface are exposed. The script executes in the viewer's browser with that viewer's permissions.
What user interaction is required for exploitation?
A viewing user must open the Attestations tab for the image associated with the malicious OCI manifest. No other trigger is specified in the available data.