A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execut…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 8, 2026 · NIST NVD

   Detected

   A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.

2. Sep 18, 2026 · NIST NVD

   Updated

   A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.

Affected

• cpe sonatype/nexus repository managerversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-3438

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-3438

  A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interact

  nvd.nist.gov

References

• Release Notes · help.sonatype.com
• Vendor Advisory · support.sonatype.com