The MCP Registry’s public catalogue UI (GET /) is vulnerable to stored cross‑site scripting. An attacker who can supply a publish token can create a malicious server.json record that sets the websiteUrl field to a string containing a double quote and an arbitrary JavaScript event handler. Because the server validates only that the string is an absolute https URL and the client inserts the value into an href attribute via innerHTML without encoding double quotes, the payload breaks out of the attribute and executes in the victim’s browser. The injected handler runs with the page’s context, allowing the attacker to steal session cookies, modify page content, or perform any JavaScript action on the registry homepage. This flaw is categorized as CWE‑79 and CWE‑116.

The vulnerability affects the modelcontextprotocol:registry product, specifically all releases earlier than version 1.7.7. Any deployment of the MCP Registry that has not yet applied the 1.7.7 fix is susceptible to this stored XSS. The issue exists in the catalogue UI served at the root path and in the server‑side validation logic for the websiteUrl field.

The CVSS score of 5.1 indicates a moderate severity overall, but the lack of an EPSS score and absence from the CISA KEV catalog does not diminish its potential impact. An attacker can achieve exploitation simply by publishing a spurious server record, which is trivial once a publish token is obtained—through a GitHub OAuth flow or an anonymous auth endpoint. All users who visit the registry homepage become exposed to the malicious payload, leading to a widespread but browser‑specific attack surface. The best mitigation is to upgrade to 1.7.7 or newer, but publishers should also reduce the attacker’s ability to supply arbitrary websiteUrl data by enforcing stricter authentication and server‑side validation.