CVE-2026-113369

Unrated

Published 2026-11-04 · last changed 2026-11-05

The fix

We hold no Microsoft remediation data for CVE-2026-113369, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest. The script runs in the browser of a user who opens the Attestations tab for the related image in the Browse user interface, with the permissions of the viewing user.

Sources

NVD record for CVE-2026-113369