A reflected XSS flaw exists in Sonatype Nexus Repository 3, affecting all releases from 3.0.0 through 3.90.2. An attacker can embed malicious JavaScript into a URL that, when a victim opens the link in a browser, is executed within the context of the Nexus web interface. The flaw originates from insufficient sanitization of user‑controlled input in the request path. The impact is the execution of arbitrary client‑side code, which could lead to session hijacking, credential theft, or defacement. The weakness is classified as CWE‑79, a standard cross‑site scripting vulnerability.

The affected product is Sonatype Nexus Repository 3. All versions from 3.0.0 up to and including 3.90.2 are vulnerable. Any deployment that serves the web UI for these versions is at risk unless mitigated or upgraded.

The CVSS score is 5.1, indicating medium severity. Exploitation requires user interaction, so the attack surface is reduced to users or compromised network paths that can deliver the crafted link. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog, suggesting it is not currently confirmed as widely exploited. Nonetheless, any user who clicks on a malicious link could be impacted, making the risk moderate for organizations whose web interfaces are exposed to external or internal users.