CVE-2026-53711

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53711

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53711.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53711

Aliases

GHSA-x6gc-rm5j-55mw

Published

2026-10-13T14:34:01Z

Modified

2026-10-14T02:48:34Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

MCP ContextForge: Global Prompts stored cross-site scripting compromises the Admin UI

Details

MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53711.json"
}

References

Affected packages

Git / github.com/ibm/mcp-context-forge

Affected ranges

Type

GIT

Repo

https://github.com/ibm/mcp-context-forge

Events

Introduced

c2fc4e9717eaf71a0041ec4f882a00e20aa3871d

Fixed

528cb285890fb2d95ba3ee5c9321f3cfa2f6f7cf

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0.2.0"
        },
        {
            "fixed":  "0.3.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.2.0

v0.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53711.json"