What is GHSA-v8cg-rx44-f2ff?

GHSA-v8cg-rx44-f2ff is a security advisory published by GitHub Security Advisories with Medium severity. Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with...

Which CVE IDs does GHSA-v8cg-rx44-f2ff cover?

GHSA-v8cg-rx44-f2ff covers the following CVE IDs: CVE-2026-17596. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-v8cg-rx44-f2ffMedium

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with...

Vendor

GitHub Security Advisories

Published

August 7, 2026

Last Modified

August 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-17596 →

📋 Description

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting (XSS). A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system health-check status. This issue has been fixed in version 3.95.0.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-17596
https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
https://support.sonatype.com/hc/en-us/articles/53871280401555
https://github.com/advisories/GHSA-v8cg-rx44-f2ff