https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 13:51:13 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44429 <p><strong>Affected:</strong> modelcontextprotocol registry</p> <p>The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go (validateWebsiteURL) only checks that the URL parses, is absolute, and uses the https scheme; it does not reject quote characters. Client-side, the value is interpolated into a double-quoted href attribute via innerHTML, using a homegrown escapeHtml helper that performs the standard textContent → innerHTML round-trip. Per the HTML serialisation algorithm, that round-trip encodes only &amp;, &lt;, &gt; and U+00A0 inside text nodes — it does not encode &#34; or &#39;. A literal &#34; in websiteUrl therefore breaks out of the href attribute, allowing arbitrary on* event handlers to be appended to the same &lt;a&gt; element. The Content-Security-Policy on / is script-src &#39;self&#39; &#39;unsafe-inline&#39; https://cdn.tailwindcss.com, so the injected event handlers execute. Any user able to obtain a publish token (e.g. via POST /v0/auth/github-at with their own GitHub account, or POST /v0/auth/none on a deployment that has anonymous auth enabled) can plant a poisoned record visible to every visitor of the registry homepage. This vulnerability is fixed in 1.7.7.</p> <p><strong>Affected:</strong> modelcontextprotocol registry</p> <p>The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.7, the public catalogue UI served at GET / (file internal/api/handlers/v0/ui_index.html) is vulnerable to stored cross-site scripting via the server.websiteUrl field of any published server.json. Server-side validation in internal/validators/validators.go (validateWebsiteURL) only checks that the URL parses, is absolute, and uses the https scheme; it does not reject quote characters. Client-side, the value is interpolated into a double-quoted href attribute via innerHTML, using a homegrown escapeHtml helper that performs the standard textContent → innerHTML round-trip. Per the HTML serialisation algorithm, that round-trip encodes only &amp;, &lt;, &gt; and U+00A0 inside text nodes — it does not encode &#34; or &#39;. A literal &#34; in websiteUrl therefore breaks out of the href attribute, allowing arbitrary on* event handlers to be appended to the same &lt;a&gt; element. The Content-Security-Policy on / is script-src &#39;self&#39; &#39;unsafe-inline&#39; https://cdn.tailwindcss.com, so the injected event handlers execute. Any user able to obtain a publish token (e.g. via POST /v0/auth/github-at with their own GitHub account, or POST /v0/auth/none on a deployment that has anonymous auth enabled) can plant a poisoned record visible to every visitor of the registry homepage. This vulnerability is fixed in 1.7.7.</p> https://cve.radiocsirt.org/vuln/cve-2026-44429