CVE-2026-113369
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI…
- Risk score
- 41/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.3 medium
References
Original description
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.
Last activity 4 Nov 2026. Patch Forecast updates every hour.