{"id":"CVE-2026-44429","sourceIdentifier":"security-advisories@github.com","published":"2026-05-14T21:16:46.677","lastModified":"2026-10-26T14:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go (validateWebsiteURL) only checks that the URL parses, is absolute, and uses the https scheme; it does not reject quote characters. Client-side, the value is interpolated into a double-quoted href attribute via innerHTML, using a homegrown escapeHtml helper that performs the standard textContent → innerHTML round-trip. Per the HTML serialisation algorithm, that round-trip encodes only &, <, > and U+00A0 inside text nodes — it does not encode \" or '. A literal \" in websiteUrl therefore breaks out of the href attribute, allowing arbitrary on* event handlers to be appended to the same <a> element. The Content-Security-Policy on / is script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com, so the injected event handlers execute. Any user able to obtain a publish token (e.g. via POST /v0/auth/github-at with their own GitHub account, or POST /v0/auth/none on a deployment that has anonymous auth enabled) can plant a poisoned record visible to every visitor of the registry homepage. This vulnerability is fixed in 1.7.7."},{"lang":"es","value":"El Registro MCP proporciona a los clientes MCP una lista de servidores MCP, como una tienda de aplicaciones para servidores MCP. Antes de la versión 1.7.7, la interfaz de usuario del catálogo público servida en GET / (archivo internal/api/handlers/v0/ui_index.html) es vulnerable a cross-site scripting almacenado a través del campo server.websiteUrl de cualquier server.json publicado. La validación del lado del servidor en internal/validators/validators.go (validateWebsiteURL) solo verifica que la URL se analiza, sea absoluta y use el esquema HTTPS; no rechaza los caracteres de comillas. Del lado del cliente, el valor se interpola en un atributo href entre comillas dobles a través de innerHTML, usando un ayudante escapeHtml de desarrollo propio que realiza el viaje de ida y vuelta estándar de textContent ? innerHTML. Según el algoritmo de serialización HTML, ese viaje de ida y vuelta codifica solo &, <, > y U+00A0 dentro de los nodos de texto - no codifica “ ni ’. Una comilla doble literal ” en websiteUrl, por lo tanto, sale del atributo href, permitiendo que controladores de eventos on arbitrarios se añadan al mismo elemento [a]. La Content-Security-Policy en / es script-src ’self’ ’unsafe-inline’ https://cdn.tailwindcss.com, por lo que los controladores de eventos inyectados se ejecutan. Cualquier usuario capaz de obtener un token de publicación (por ejemplo, a través de POST /v0/auth/github-at con su propia cuenta de GitHub, o POST /v0/auth/none en una implementación que tenga la autenticación anónima habilitada) puede plantar un registro envenenado visible para cada visitante de la página de inicio del registro. Esta vulnerabilidad se corrige en la versión 1.7.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"modelcontextprotocol","product":"registry","versions":[{"version":"< 1.7.7","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-15T14:19:51.887565Z","id":"CVE-2026-44429","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lfprojects:mcp_registry:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.7","matchCriteriaId":"158B1594-CF93-4F53-85DE-7909E8E4B136"}]}]}],"references":[{"url":"https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}