---
id: "CVE-2026-113369"
kind: "vulnerability"
aliases: ["CVE-2026-113369"]
title: "Sonatype Nexus Repository: stored script in OCI manifests runs in viewers' browsers"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["container-registry", "infrastructure", "nexus-repository", "oci", "self-hosted"]
not_affected_if: ["no-hosted-oci-repository", "no-untrusted-edit-users"]
published_at: "2026-11-04T20:18:55+00:00"
first_seen_at: "2026-11-04T20:29:02+00:00"
updated_at: "2026-11-04T20:30:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113369", "first_seen_at": "2026-11-04T20:29:02+00:00"}]
---

# Sonatype Nexus Repository: stored script in OCI manifests runs in viewers' browsers

A user who can push manifests to a hosted OCI repository in Sonatype Nexus Repository 3 can store script content in an image manifest's artifact type field. The script runs in the browser of anyone who opens the Attestations tab for that image in the Browse interface, with that viewer's permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Nexus Repository 3 version in the web UI or the product's about page; the sources do not name the affected version range.
- Review which accounts hold edit permission on hosted OCI repositories.

## Timeline

- 2026-11-04T20:29:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113369

## From the sources

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_