CVE-2026-17595: Nexus Repository 3 - JEXL Content Selector Sandbox Property-Read Bypass
Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct an expression that read Java object properties not intended to be exposed to the expression engine, disclosing internal JVM class metadata such as class and classloader names. This issue does not permit method invocation, object construction, or arbitrary code execution. This has been fixed by restricting property access in the JEXL sandbox to the intended data types.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update Nexus Repository 3 so the JEXL sandbox used by Content Selectors restricts property access to the intended data types (property-read bypass fix).
Nexus Repository 3 (JEXL Content Selector sandbox) JEXL sandbox property access = Restrict property reads to the intended data types
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17595?
CVE-2026-17595 has a risk score of 23, indicating a critical security vulnerability.
How do I fix CVE-2026-17595?
To mitigate CVE-2026-17595, ensure you update your Sonatype Nexus Repository 3 to the latest version that addresses this vulnerability.
What software is affected by CVE-2026-17595?
CVE-2026-17595 affects Sonatype Nexus Repository 3.
What type of vulnerability is CVE-2026-17595?
CVE-2026-17595 is a sandbox property-read bypass vulnerability in JEXL expressions used within Content Selectors.
What could an attacker gain by exploiting CVE-2026-17595?
Exploiting CVE-2026-17595 could allow an attacker to read sensitive Java object properties and disclose internal JVM class metadata.