# CVE-2026-97667: Sonatype Nexus Repository 3 stored cross-site scripting in R repository metadata

Source: https://junglewise.ai/threats/cve-2026-97667-sonatype-nexus-repository-3-allows-a-user-account-that-holds-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-97667 · Severity: info · Published 2026-10-15

Sonatype Nexus Repository 3 is a software component repository manager used to store and distribute libraries and packages. A user with edit permissions on an R repository can inject malicious scripts into package metadata that execute in the browser of anyone viewing the package details, potentially allowing administrative actions if an administrator views the affected package.

Technologies: [Sonatype Nexus Repository 3](https://junglewise.ai/threats/technologies/nexus-repository-3). Vendors: [Sonatype](https://junglewise.ai/threats/vendors/sonatype).

## Quick answers

**Is CVE-2026-97667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97667 being exploited in the wild.

**How severe is CVE-2026-97667?** Informational severity, published 15 October 2026.

**Which products and versions are affected?** Sonatype Nexus Repository 3 3.28.0 to 3.96.x.

**Is there a fix for CVE-2026-97667?** Yes: fixed in Nexus Repository 3 CE/Pro version 3.97.0. Until then: Restrict edit permission on hosted R repositories (nx-repository-view-r-*-edit) to fully trusted users and do not grant it to the anonymous user. Delete any unused hosted R repositories. Restrict network-level access to the Nexus Repository web interface to trusted networks only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97667 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-97667?** Check whether you run Sonatype Nexus Repository 3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Nexus Repository 3 CE/Pro version 3.97.0

Restrict edit permission on hosted R repositories (nx-repository-view-r-*-edit) to fully trusted users and do not grant it to the anonymous user. Delete any unused hosted R repositories. Restrict network-level access to the Nexus Repository web interface to trusted networks only.

## Technical details

This is a stored cross-site scripting vulnerability in the Browse user interface affecting R repository metadata handling. An authenticated user with the nx-repository-view-r-*-edit permission can upload an R package with embedded script content in its metadata. The script executes in the browser of any user who views the package details, running with that user's permissions; if an administrator views it, the attacker gains administrative access to the instance.

## Affected products

- Sonatype Nexus Repository 3 3.28.0 to 3.96.x

## Timeline

- 2026-10-15: disclosed
- 2026-10-15: patched

## References

- [https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html](https://help.sonatype.com/en/sonatype-nexus-repository-3-97-0-release-notes.html)
- [https://support.sonatype.com/hc/en-us/articles/56207477462035/](https://support.sonatype.com/hc/en-us/articles/56207477462035/)

## Related threats

- [Sonatype Nexus Repository 3 authorization bypass in Rut Auth capability](https://junglewise.ai/threats/cve-2026-113374-sonatype-nexus-repository-3-does-not-require-realm)
- [Sonatype Nexus Repository 3 YUM private key disclosure to read-only accounts](https://junglewise.ai/threats/cve-2026-113372-sonatype-nexus-repository-3-returns-the-private-signing-key-of-a)
- [Sonatype Nexus Repository 3 signing passphrase disclosure in REST endpoint](https://junglewise.ai/threats/cve-2026-113371-sonatype-nexus-repository-3-returns-the-signing-passphrase-of-an)
- [Sonatype Nexus Repository 3 SQL injection in Reindex Search Tables task](https://junglewise.ai/threats/cve-2026-113370-sonatype-nexus-repository-3-contains-a-sql-injection)
- [Sonatype Nexus Repository stored XSS in OCI manifest artifact type](https://junglewise.ai/threats/cve-2026-113369-sonatype-nexus-repository-3-allows-a-user-account-that-can-push)