CVE-2026-113369 · Infrastructure
NO FIX YET
A user who can push manifests to a hosted OCI repository in Sonatype Nexus Repository 3 can store script content in an image manifest's artifact type field. The script runs in the browser of anyone who opens the Attestations tab for that image in the Browse interface, with that viewer's permissions.
first public Nov 4, 2026 · 1 source
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams that run Sonatype Nexus Repository 3 with hosted OCI (container image) repositories where some users have edit permission on those repositories. The attacker needs an account that can push manifests, and a victim must open the Attestations tab for the affected image in the Browse interface. Instances without hosted OCI repositories or without such accounts are not exposed.
Not affected if no-hosted-oci-repository, no-untrusted-edit-users
Who cares container-registry, nexus-repository, oci, self-hosted
No fix yet, per the sources.
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.
This page as .md · .json · in your agent: get_signal("CVE-2026-113369") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.