A flaw in the task management component of Sonatype Nexus Repository Manager allows an authenticated user who can create tasks to submit malicious data that is executed as code when the task runs. By crafting a vulnerability‑laden task, the attacker can bypass the nexus.scripts.allowCreation control and run arbitrary commands with the privileges of the Nexus process, compromising confidentiality, integrity, and availability.

Sonatype Nexus Repository Manager versions 3.22.1 through 3.90.2 are affected. This includes all releases in that range as listed by the CNA.

The CVSS score of 9.4 signals a high‑magnitude risk. Exploitation requires the attacker to be authenticated and possess task creation rights, a permission typically held by developers or administrators. No public exploitation data is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Once the attacker submits a malicious task, code executes with the Nexus process privileges, giving the attacker full control over the server.