The MCP Registry serves a public catalogue UI listing MCP servers. Versions before 1.7.7 are vulnerable to stored XSS via the server.websiteUrl field in published server.json files. Server-side validation only ensures the URL parses, is absolute, and uses HTTPS, but does not reject quote characters. Client-side, the URL is inserted into a double-quoted href attribute using a custom escapeHtml function that does not encode quotes, allowing injection of arbitrary on* event handlers. The Content-Security-Policy permits inline scripts, enabling execution of injected handlers. Any user with a publish token can exploit this to inject malicious scripts visible to all visitors. The issue is resolved in version 1.7.7.

An attacker with publish token access can inject malicious JavaScript into the MCP registry homepage, potentially executing arbitrary scripts in the context of users visiting the page. This could lead to session hijacking, defacement, or other client-side attacks. The vulnerability requires at least low privileges (publish token) and user interaction (visiting the page). No known exploits in the wild have been reported.

This vulnerability is fixed in modelcontextprotocol registry version 1.7.7. Users should upgrade to version 1.7.7 or later to remediate this issue. No official patch or temporary fix is indicated other than upgrading. Until upgraded, restrict publish token issuance to trusted users only to reduce risk.