A user possessing edit permission on a hosted OCI repository can embed malicious script content into the artifact type field of an OCI manifest. When a viewer opens the Attestations tab for that image in the Nexus Repository web interface, the script executes in the viewer’s browser, enabling the attacker to steal credentials, deface the UI, or perform phishing attacks. The weakness is classic client‑side script injection, identified as CWE‑79.

Sonatype Nexus Repository Manager 3 versions 3.94.0 through 3.97.1 are vulnerable. Any instance with hosted OCI repositories where users can push manifests with edit rights is affected. The vulnerability originates in the handling of the artifact type field within OCI manifests.

The attack requires the attacker to have edit authority on an OCI repository, a privilege typically held by internal users or compromised accounts. From this position the attacker can push a crafted manifest; no additional network or code‑execution privileges are needed. The CVSS score of 6.3 indicates a moderate severity, while the EPSS score is not available and the issue is not yet listed in CISA’s KEV catalog. If exploited, the attack compromises confidentiality, integrity, and availability for all users who view the affected artifact in a web browser.