# CVE-2026-3438: Sonatype Nexus Repository reflected XSS

Source: https://junglewise.ai/threats/cve-2026-3438-sonatype-nexus-repository-reflected-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-3438 · Severity: info · CVSS 5.1 · Published 2026-04-08

Sonatype Nexus Repository, a platform used by developers to manage and distribute software components, is affected by a security flaw that could allow an attacker to run malicious scripts in a user's web browser. To exploit this, an attacker would need to trick a logged-in user into clicking a specially crafted link. If successful, this could allow the attacker to perform actions on behalf of the user or steal sensitive session information.

Technologies: [Sonatype Nexus Repository](https://junglewise.ai/threats/technologies/nexus-repository). Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2026-3438 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3438 being exploited in the wild.

**How severe is CVE-2026-3438?** Informational severity, with a CVSS score of 5.1, published 8 April 2026.

**Which products and versions are affected?** Sonatype Nexus Repository 3.0.0 through 3.90.2.

**Is there a fix for CVE-2026-3438?** A patch was published on 2026-04-08: Fixed in version 3.91.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3438 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-3438?** Check whether you run Sonatype Nexus Repository at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2. The flaw is caused by improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by sending a specially crafted URL to a victim; if the victim clicks the link, arbitrary JavaScript will execute within the context of their browser session. This can lead to session hijacking or unauthorized actions performed on behalf of the user. The issue is resolved in version 3.91.0.

## Affected products

- Sonatype Nexus Repository 3.0.0 through 3.90.2

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-04-08: patched: Fixed in version 3.91.0

## References

- [https://help.sonatype.com/en/sonatype-nexus-repository-3-91-0-release-notes.html](https://help.sonatype.com/en/sonatype-nexus-repository-3-91-0-release-notes.html)
- [https://support.sonatype.com/hc/en-us/articles/50609137161363](https://support.sonatype.com/hc/en-us/articles/50609137161363)

## Related threats

- [Sonatype Nexus Repository privilege escalation in script execution](https://junglewise.ai/threats/cve-2026-77124-sonatype-nexus-repository-privilege-escalation-in-script)
- [Sonatype Nexus Repository denial of service via oversized POM metadata](https://junglewise.ai/threats/cve-2026-77121-sonatype-nexus-repository-denial-of-service-via-oversized-pom)
- [Sonatype Nexus Repository 3 SSRF in SSL Certificate Retrieval endpoint](https://junglewise.ai/threats/cve-2026-7494-sonatype-nexus-repository-3-ssrf-in-ssl-certificate-retrieval)
- [Sonatype Nexus Repository improper restriction of authentication attempts](https://junglewise.ai/threats/cve-2026-3329-sonatype-nexus-repository-improper-restriction-of-authentication)
- [An authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript…](https://junglewise.ai/threats/cve-2026-7308-sonatype-nexus-repository-stored-xss-in-html-index-page)