{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0601", "assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11", "state": "PUBLISHED", "assignerShortName": "Sonatype", "dateReserved": "2026-01-05T12:59:29.563Z", "datePublished": "2026-01-14T22:05:17.135Z", "dateUpdated": "2026-01-15T14:43:42.991Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:sonatype:nexus_repository_manager:3.82.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.83.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.83.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.83.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.84.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.84.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.85.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Nexus Repository", "vendor": "Sonatype", "versions": [{"lessThanOrEqual": "3.87.1", "status": "affected", "version": "3.82.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Piotr Bazydlo (@chudyPB) of watchTowr"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction."}], "value": "A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "103e4ec9-0a87-450b-af77-479448ddef11", "shortName": "Sonatype", "dateUpdated": "2026-01-14T22:05:17.135Z"}, "references": [{"tags": ["patch"], "url": "https://help.sonatype.com/en/sonatype-nexus-repository-3-88-0-release-notes.html"}, {"tags": ["vendor-advisory"], "url": "https://support.sonatype.com/hc/en-us/articles/47934334375955"}], "source": {"discovery": "EXTERNAL"}, "title": "Nexus Repository 3 - Cross-Site Scripting", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-15T14:42:58.004555Z", "id": "CVE-2026-0601", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T14:43:42.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T14:42:58.004555Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T14:43:28.009Z"}}], "cna": {"title": "Nexus Repository 3 - Cross-Site Scripting", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Piotr Bazydlo (@chudyPB) of watchTowr"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:sonatype:nexus_repository_manager:3.82.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.83.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.83.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.83.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.84.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.84.1:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.85.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.86.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.86.2:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.87.0:*:*:*:*:*:*:*", "cpe:2.3:a:sonatype:nexus_repository_manager:3.87.1:*:*:*:*:*:*:*"], "vendor": "Sonatype", "product": "Nexus Repository", "versions": [{"status": "affected", "version": "3.82.0", "versionType": "semver", "lessThanOrEqual": "3.87.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://help.sonatype.com/en/sonatype-nexus-repository-3-88-0-release-notes.html", "tags": ["patch"]}, {"url": "https://support.sonatype.com/hc/en-us/articles/47934334375955", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.", "supportingMedia": [{"type": "text/html", "value": "A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "103e4ec9-0a87-450b-af77-479448ddef11", "shortName": "Sonatype", "dateUpdated": "2026-01-14T22:05:17.135Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0601", "state": "PUBLISHED", "dateUpdated": "2026-01-15T14:43:42.991Z", "dateReserved": "2026-01-05T12:59:29.563Z", "assignerOrgId": "103e4ec9-0a87-450b-af77-479448ddef11", "datePublished": "2026-01-14T22:05:17.135Z", "assignerShortName": "Sonatype"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting reflejado existe en Nexus Repository 3 que permite a atacantes no autenticados ejecutar JavaScript arbitrario en el navegador de una v\u00edctima a trav\u00e9s de una solicitud especialmente dise\u00f1ada que requiere interacci\u00f3n del usuario."}], "id": "CVE-2026-0601", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "103e4ec9-0a87-450b-af77-479448ddef11", "type": "Secondary"}]}, "published": "2026-01-14T22:15:52.960", "references": [{"source": "103e4ec9-0a87-450b-af77-479448ddef11", "url": "https://help.sonatype.com/en/sonatype-nexus-repository-3-88-0-release-notes.html"}, {"source": "103e4ec9-0a87-450b-af77-479448ddef11", "url": "https://support.sonatype.com/hc/en-us/articles/47934334375955"}], "sourceIdentifier": "103e4ec9-0a87-450b-af77-479448ddef11", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "103e4ec9-0a87-450b-af77-479448ddef11", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:13:28.095976+00:00", "value": {"mitigation_remediation": ["Upgrade Sonatype Nexus Repository Manager to version 3.88.0 or newer following the official release notes.", "If an immediate upgrade is not feasible, restrict unauthenticated access to the web interface or disable any features that expose query parameters to reflected output.", "Implement a strict Content\u2011Security\u2011Policy on browsers interacting with Nexus to block the execution of unexpected scripts.", "Validate all input data on the server side to ensure that no malicious code can be injected through query strings or form fields."], "summary": {"action": "Apply Patch", "impact": "Cross\u2011Site Scripting (reflected)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Sonatype Nexus Repository Manager, specifically versions 3.82.0 through 3.87.1 inclusive, as identified by the CNA. All releases prior to 3.88.0 lack the mitigations announced in the official 3.88.0 release notes. The affected components are the web interface that processes query parameters and renders them without proper sanitization.", "description_and_impact": "A reflected cross\u2011site scripting vulnerability exists in Nexus Repository 3 that permits an unauthenticated attacker to execute arbitrary JavaScript in a victim\u2019s browser. The flaw is triggered when a victim accesses a specially crafted request; the malicious payload is reflected back and executed. Because the payload is not stored on the server, the impact is limited to the session of the victim\u2019s browser, but it could enable cookie theft, session hijacking, or phishing attacks.", "risk_and_exploitability": "The CVSS v3.1 score is 5.1, indicating moderate severity. EPSS is less than 1%, meaning the probability of exploitation is presently low, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires that an attacker sends a crafted request to an unauthenticated end\u2011user, who must then interact with the resulting page for the script to run. No authentication or privileged access is needed, making the threat accessible to anyone with a web browser. Because the vulnerability is reflected, it does not persist on the server, but it can still be leveraged to compromise user sessions or conduct phishing attacks."}}}}, "created": "2026-04-18T06:15:15.875071+00:00", "updated": "2026-04-18T06:15:15.875082+00:00", "vendors": []}