An authenticated user with upload rights can store content that contains malicious JavaScript within a hosted repository. When any user views that repository directory through the HTML index page, the injected script runs in the victim’s browser, allowing the attacker to perform actions in the victim’s session. This reflects a classic stored cross‑site scripting weakness (CWE‑79).

The vulnerability affects Sonatype Nexus Repository 3 releases from version 3.6.0 up to, but not including, 3.92.0. All intermediate builds within this range are impacted, including the latest 3.91.1 builds. Users running older 3.x versions do not fall under this issue.

The CVSS score is 5.1, indicating medium severity. No EPSS score is currently available and the issue is not listed in the CISA KEV catalog, implying no documented widespread exploitation. The attack requires an authenticated user with repository upload privileges; it cannot be triggered by a public internet attacker. The main threat is that anyone who browses the affected repository directory will have the victim’s browser used as a vector for unintended session‑baselined actions.