A user who holds edit permission on a hosted R repository can upload an R package whose metadata contains malicious script. When any authenticated user opens the package details in the Browse UI, the script executes in that user’s browser with the user’s privileges. The vulnerability allows attackers to inject and execute arbitrary JavaScript, which can lead to cookie theft, session hijacking, phishing or malicious navigation. The impact is confined to the browser context of the viewing user and does not provide server‑side code execution.

Sonatype Nexus Repository 3 versions from 3.28.0 through 3.96.4 are affected. The vulnerability exists in the component that renders package metadata in the Browse interface and can be triggered by any account possessing edit rights on a hosted repository, including anonymous accounts when enabled. The node (repo) must be a hosted R repository.

The CVSS score of 5.1 indicates moderate severity and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV database. Attack requires valid credentials with edit permission; thus, the exploitation window hinges on the presence of such accounts. A determined attacker could compromise the browser session of any repository user, but the technical barriers and low exploit probability reduce the overall risk. No public exploit is reported as of the data provided.