Nexus Repository 3 used an insecure implementation of the JEXL sandbox for Content Selector expressions (CWE‑497). The vulnerability allows an account that holds the nexus:selectors:create permission to craft an expression that reads Java object properties beyond the intended sandbox. This results in disclosure of internal JVM class metadata, such as class and classloader names, without enabling method invocation, object construction, or arbitrary code execution.

Sonatype Nexus Repository 3 versions up to and including 3.94.1 are affected. The issue is present in all enumerated releases and applies to any installation that permits selector creation via its permission model.

The CVSS score of 5.3 indicates a moderate confidentiality impact and does not reflect availability or integrity impact. No EPSS data is provided, so the current exploit prevalence is unknown. The flaw is not listed in the CISA KEV catalog and has no publicly documented exploits. An attacker must possess the nexus:selectors:create privilege, which is normally granted to administrators or automated processes that manage selectors. If that privilege is tightly controlled, the attack surface is reduced; however, assigned accounts could still enumerate JVM class descriptors.