{“lastseen”:””,”description”:”The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET \/ (file internal\/api\/handlers\/v0\/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal\/validators\/validators.go (validateWebsiteURL) only checks that the URL parses, is absolute, and uses the https scheme; it does not reject quote characters. Client-side, the value is interpolated into a double-quoted href attribute via innerHTML, using a homegrown escapeHtml helper that performs the standard textContent \u2192 innerHTML round-trip. Per the HTML serialisation algorithm, that round-trip encodes only \\u0026, \\u003c, \\u003e and U+00A0 inside text nodes \u2014 it does not encode \\” or ‘. A literal \\” in websiteUrl therefore breaks out of the href attribute, allowing arbitrary on* event handlers to be appended to the same \\u003ca\\u003e element. The Content-Security-Policy on \/ is script-src ‘self’ ‘unsafe-inline’ https:\/\/cdn.tailwindcss.com, so the injected event handlers execute. Any user able to obtain a publish token (e.g. via POST \/v0\/auth\/github-at with their own GitHub account, or POST \/v0\/auth\/none on a deployment that has anonymous auth enabled) can plant a poisoned record visible to every visitor of the registry homepage. This vulnerability is fixed in 1.7.7.”,”published”:”2026-05-14T21:05:56.130Z”,”modified”:”2026-05-14T21:05:56.130Z”,”type”:”cve”,”title”:”MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`”,”source”:”GitHub_M”,”references”:”https:\/\/github.com\/modelcontextprotocol\/registry\/security\/advisories\/GHSA-rqv2-m695-f8j4″,”id”:”CVE-2026-44429″,”bulletinFamily”:””,”cwe”:[“CWE-79″,”CWE-116″],”cvelist”:null,”sourceData”:”modelcontextprotocol registry \\u003c 1.7.7″,”sourceHref”:””,”cvss”:{“score”:5.1,”severity”:”MEDIUM”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:L\/UI:P\/VC:N\/VI:N\/VA:N\/SC:N\/SI:L\/SA:L”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”registry”,”version”:”\\u003c 1.7.7″,”vendor”:”modelcontextprotocol”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,109,12,21,13,7,11,5],"class_list":["post-54661","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-51","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n