{"id":"EUVD-2026-30487","enisaUuid":"d488e0ae-d8dd-3a10-8dfa-b4ad2fc94672","description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go (validateWebsiteURL) only checks that the URL parses, is absolute, and uses the https scheme; it does not reject quote characters. Client-side, the value is interpolated into a double-quoted href attribute via innerHTML, using a homegrown escapeHtml helper that performs the standard textContent → innerHTML round-trip. Per the HTML serialisation algorithm, that round-trip encodes only \u0026, \u003c, \u003e and U+00A0 inside text nodes — it does not encode \" or \u0027. A literal \" in websiteUrl therefore breaks out of the href attribute, allowing arbitrary on* event handlers to be appended to the same \u003ca\u003e element. The Content-Security-Policy on / is script-src \u0027self\u0027 \u0027unsafe-inline\u0027 https://cdn.tailwindcss.com, so the injected event handlers execute. Any user able to obtain a publish token (e.g. via POST /v0/auth/github-at with their own GitHub account, or POST /v0/auth/none on a deployment that has anonymous auth enabled) can plant a poisoned record visible to every visitor of the registry homepage. This vulnerability is fixed in 1.7.7.","datePublished":"May 14, 2026, 9:05:56 PM","dateUpdated":"May 15, 2026, 2:20:27 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L","references":"https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4\n","aliases":"CVE-2026-44429\nGHSA-rqv2-m695-f8j4\n","assigner":"GitHub_M","epss":0.17,"enisaIdProduct":[{"id":"3d2b7547-76e3-3f5a-be83-1417a117c956","product":{"name":"registry","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 1.7.7"}],"enisaIdVendor":[{"id":"39eb842f-33d3-3c05-9a82-c6868ce3b4e1","vendor":{"name":"modelcontextprotocol"}}],"enisaIdVulnerability":[{"id":"449ebfbc-ddcd-3e09-8d45-883aead7918e","vulnerability":{"id":"GHSA-rqv2-m695-f8j4","description":"MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`","datePublished":"May 8, 2026, 5:18:32 PM","dateUpdated":"May 15, 2026, 11:46:13 PM","baseScore":0.0,"references":"https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44429\nhttps://github.com/modelcontextprotocol/registry/pull/1249\nhttps://github.com/modelcontextprotocol/registry/commit/78b7bbde07948049b916d76b4769faee461ff930\nhttps://github.com/modelcontextprotocol/registry\nhttps://github.com/modelcontextprotocol/registry/releases/tag/v1.7.7\n","enisa_id":"EUVD-2026-30487\n","aliases":"GHSA-rqv2-m695-f8j4\nCVE-2026-44429\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ddf20d65-f8e8-3cf5-9c83-20d6e10704e3","vulnerability":{"id":"CVE-2026-44429","description":"The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go (validateWebsiteURL) only checks that the URL parses, is absolute, and uses the https scheme; it does not reject quote characters. Client-side, the value is interpolated into a double-quoted href attribute via innerHTML, using a homegrown escapeHtml helper that performs the standard textContent → innerHTML round-trip. Per the HTML serialisation algorithm, that round-trip encodes only \u0026, \u003c, \u003e and U+00A0 inside text nodes — it does not encode \" or \u0027. A literal \" in websiteUrl therefore breaks out of the href attribute, allowing arbitrary on* event handlers to be appended to the same \u003ca\u003e element. The Content-Security-Policy on / is script-src \u0027self\u0027 \u0027unsafe-inline\u0027 https://cdn.tailwindcss.com, so the injected event handlers execute. Any user able to obtain a publish token (e.g. via POST /v0/auth/github-at with their own GitHub account, or POST /v0/auth/none on a deployment that has anonymous auth enabled) can plant a poisoned record visible to every visitor of the registry homepage. This vulnerability is fixed in 1.7.7.","datePublished":"May 14, 2026, 9:05:56 PM","dateUpdated":"May 15, 2026, 2:20:27 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L","references":"https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4\n","enisa_id":"EUVD-2026-30487\n","assigner":"GitHub_M","epss":0.17,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"9e02f197-c100-37dc-bcbb-6dda928dddb3","product":{"name":"registry","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 1.7.7"}],"vulnerabilityVendor":[{"id":"55db3eb6-ca3f-3f51-8da5-fb39df911411","vendor":{"name":"modelcontextprotocol"}}]}}],"enisaIdAdvisory":[]}