XSS in Sonatype Nexus Repository

CVE-2026-0601

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (31.3th percentile) — read the EPSS interpretation.