PT-2026-31545 · Sonatype · Sonatype Nexus Repository

Published 2026-04-08 · Updated 2026-04-09 · CVE-2026-3438

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository versions 3.0.0 through 3.90.2

Description A reflected cross-site scripting issue exists that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.

Recommendations Update Sonatype Nexus Repository to a version later than 3.90.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3438

Affected Products

Sonatype Nexus Repository

References · 6

• https://support.sonatype.com/hc/en-us/articles/50609137161363 · Vendor Advisory
• https://help.sonatype.com/en/sonatype-nexus-repository-3-91-0-release-notes.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-3438 · Security Note
• https://twitter.com/CVEnew/status/2042010556991701396 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042141889713840557 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042013074345886056 · Twitter Post