What’s Vulnerable › Vulnerabilities

CVE-2025-13488: Nexus Repository 3 - Stored Cross-Site Scripting (XSS)

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-04 · updated 2026-10-18
• Weakness: CWE-79

Description

Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may allow an authenticated attacker with repository upload privileges to exploit a stored cross-site scripting (XSS) vulnerability with user context.

Affected products

• Sonatype Nexus Repository 3: from 3.83.0 through 3.86.2

References

• https://help.sonatype.com/en/sonatype-nexus-repository-3-87-0-release-notes.html
• https://support.sonatype.com/hc/en-us/articles/46896142768019

Get alerted when CVE-2025-13488 or the next vulnerability affects your stack