MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-44429 · Microsoft / collected KEV context

EUVD-2026-30487

GHSA-rqv2-m695-f8j4

GO-2026-5637

cve-program · CVE-2026-44429

• https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4

euvd · EUVD-2026-30487

• https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4

nvd · CVE-2026-44429

• https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4

osv · GHSA-rqv2-m695-f8j4

• https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4
• https://nvd.nist.gov/vuln/detail/CVE-2026-44429
• https://github.com/modelcontextprotocol/registry/pull/1249
• https://github.com/modelcontextprotocol/registry/commit/78b7bbde07948049b916d76b4769faee461ff930
• https://github.com/modelcontextprotocol/registry
• https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.7

osv · GO-2026-5637

• https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-rqv2-m695-f8j4
• https://nvd.nist.gov/vuln/detail/CVE-2026-44429
• https://github.com/modelcontextprotocol/registry/commit/78b7bbde07948049b916d76b4769faee461ff930
• https://github.com/modelcontextprotocol/registry/pull/1249
• https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.7

No related operational record is retained in the current change model.