{"id":"CVE-2026-113369","kind":"vulnerability","aliases":["CVE-2026-113369"],"related":[],"title":"Sonatype Nexus Repository: stored script in OCI manifests runs in viewers' browsers","description":"Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.","summary":"A user who can push manifests to a hosted OCI repository in Sonatype Nexus Repository 3 can store script content in an image manifest's artifact type field. The script runs in the browser of anyone who opens the Attestations tab for that image in the Browse interface, with that viewer's permissions.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["container-registry","infrastructure","nexus-repository","oci","self-hosted"],"not_affected_if":["no-hosted-oci-repository","no-untrusted-edit-users"],"how_to_check":"- Check the installed Nexus Repository 3 version in the web UI or the product's about page; the sources do not name the affected version range.\n- Review which accounts hold edit permission on hosted OCI repositories.","fix":null,"status":"open","published_at":"2026-11-04T20:18:55+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","triaged_at":"2026-11-04T20:30:05+00:00","updated_at":"2026-11-04T20:30:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-04T20:30:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Sonatype Nexus Repository: stored script in OCI manifests runs in viewers' browsers","impact":"medium","summary":"A user who can push manifests to a hosted OCI repository in Sonatype Nexus Repository 3 can store script content in an image manifest's artifact type field. The script runs in the browser of anyone who opens the Attestations tab for that image in the Browse interface, with that viewer's permissions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["nexus-repository","oci","container-registry","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in a viewer's browser with their permissions","analyst_note":"Confirm affected and fixed Nexus Repository 3 versions from the vendor advisory; the NVD entry alone does not give version ranges or a fix.","how_to_check":"- Check the installed Nexus Repository 3 version in the web UI or the product's about page; the sources do not name the affected version range.\n- Review which accounts hold edit permission on hosted OCI repositories.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-hosted-oci-repository","no-untrusted-edit-users"],"who_is_affected":"Teams that run Sonatype Nexus Repository 3 with hosted OCI (container image) repositories where some users have edit permission on those repositories. The attacker needs an account that can push manifests, and a victim must open the Attestations tab for the affected image in the Browse interface. Instances without hosted OCI repositories or without such accounts are not exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000723,"input_tokens":4148,"output_tokens":617,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113369':15A,18A '-2026':14A,17A '3':45B,86C 'account':90C,102C 'allow':87C 'anyon':65B 'artifact':55B,117C 'attest':69B,136C 'brows':76B,144C 'browser':12A,63B,129C 'contain':20B 'container-registri':19B 'content':49B,114C 'cve':13A,16A 'edit':106C 'field':57B,119C 'hold':104C 'host':29B,38B,97C 'imag':52B,73B,141C 'infrastructur':22B 'interfac':77B,146C 'manifest':8A,35B,53B,94C,123C 'nexus':2A,24B,43B,84C 'nexus-repositori':23B 'oci':7A,26B,39B,98C,122C 'open':67B,134C 'permiss':82B,107C,149C 'push':34B,93C 'registri':21B 'relat':140C 'repositori':3A,25B,40B,44B,85C,99C,110C 'run':9A,60B,126C 'script':5A,48B,59B,113C,125C 'self':28B 'self-host':27B 'sonatyp':1A,42B,83C 'store':4A,47B,112C 'tab':70B,137C 'type':56B,118C 'user':31B,89C,101C,132C,145C,153C 'view':152C 'viewer':11A,80B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Sonatype Nexus Repository 3 with hosted OCI (container image) repositories where some users have edit permission on those repositories. The attacker needs an account that can push manifests, and a victim must open the Attestations tab for the affected image in the Browse interface. Instances without hosted OCI repositories or without such accounts are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containerregistry","infrastructure","medium","nexusrepository","oci","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T20:18:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"103e4ec9-0a87-450b-af77-479448ddef11","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113369","severity":null,"published_at":"2026-11-04T20:18:55+00:00","modified_at":"2026-11-04T20:18:55+00:00","first_seen_at":"2026-11-04T20:29:02+00:00","fetched_at":"2026-11-04T20:29:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}