Skip to content

olgasafonova/mediawiki-mcp-server

v1.17.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 5mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

anthropic claude go mcp mcp-server mediawiki
+4 more
model-context-protocol starred wiki wikipedia

Affected surfaces

rce_ssrf

Summary

AI summary

DNS resolution failures now block requests to prevent SSRF bypass attempts.

Full changelog

Security Improvements

Fail-Closed DNS Handling

DNS resolution failures now block requests instead of allowing them through. This prevents DNS-based SSRF bypass attempts where attackers use timing tricks to evade validation.

Structured Error Codes

Added programmatic error codes for automated error handling:

| Code | Description |
|------|-------------|
| SSRF_PRIVATE_IP | URL resolves to private/internal IP |
| SSRF_DNS_ERROR | DNS resolution failed (blocked) |
| SSRF_REDIRECT_BLOCKED | Redirect target is private |
| SSRF_INVALID_URL | URL format is invalid |

Additional error codes added for rate limiting, validation, authentication, and not found errors.

Full Changelog: https://github.com/olgasafonova/mediawiki-mcp-server/compare/v1.17.4...v1.17.5

Security Fixes

  • Fail-closed DNS handling blocks requests on resolution failure (prevents SSRF bypass) – new code `SSRF_DNS_ERROR`
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track olgasafonova/mediawiki-mcp-server

Get notified when new releases ship.

Sign up free

About olgasafonova/mediawiki-mcp-server

Connect to any MediaWiki wiki (Wikipedia, Fandom, corporate wikis). 33+ tools for search, read, edit, link analysis, revision history, and Markdown conversion. Supports stdio and HTTP transport.

All releases →

Related context

Earlier breaking changes

  • v1.31.0 rationale parameter now required on 7 destructive MCP tools

Beta — feedback welcome: [email protected]