The vulnerability allows a user who can update data stores to set the HikariCP property connectionInitSql. This property lets the attacker inject arbitrary SQL that executes each time a new database connection is created. On the default in‑memory H2 database, the injected SQL can trigger native OS commands, leading to remote code execution as the Nexus process user. This is a classic SQL injection flaw (CWE-94) that grants attackers code‑execution privileges without needing higher permissions beyond the datastore update role.

Affected are Sonatype Nexus Repository 3 installations from version 3.20.0 up through 3.94.1. All releases listed in the CPEs share the same unpatched HikariCP connector configuration without proper validation. Affected deployments include any that use the DataStore configuration API and have the nx-datastores‑update permission granted to users.

The CVSS score of 8.7 indicates high severity. With no EPSS data available, the probability of exploitation is unclear, but the vulnerability is not listed in CISA KEV. Because the flaw requires the nx-datastores‑update role, exploitation typically comes from an authenticated administrator or a compromised account with that permission. Once injected, the arbitrary SQL runs under the Nexus process context, allowing full access to the server’s filesystem and arbitrary code execution.