CVE-2026-0601

A reflected cross-site scripting (XSS) vulnerability exists in Sonatype Nexus Repository 3 versions 3.82.0 through 3.87.1 (CE/Pro). The flaw allows an unauthenticated attacker to inject arbitrary JavaScript into a page via a specially crafted request, as the application fails to properly sanitize user input [2].

Exploitation requires user interaction: the victim must visit a malicious page or click a crafted link while authenticated to a vulnerable Nexus Repository instance. The attacker does not need any authentication [2].

If exploited, the attacker can execute arbitrary JavaScript in the victim's browser, potentially performing actions on behalf of the victim. This could lead to privilege escalation (e.g., creating administrative accounts), session hijacking, or unauthorized configuration changes [2].

The vulnerability is fixed in Nexus Repository version 3.88.0, released on January 13, 2026. Users running affected versions should upgrade immediately. No workarounds have been provided [1][2].