Skip to content

olgasafonova/mediawiki-mcp-server

v1.17.6 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 5mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

anthropic claude go mcp mcp-server mediawiki
+4 more
model-context-protocol starred wiki wikipedia

Affected surfaces

auth rbac

Summary

AI summary

Added Unicode NFC normalization to page titles, content validation, and search queries to prevent bypass attacks.

Full changelog

Security Improvement

Unicode NFC Normalization

Added Unicode NFC normalization to prevent bypass attacks using alternative character representations:

  • Combining characters: cafe\u0301 → café
  • Alternative encodings: Different Unicode forms of the same visual character
  • Homoglyph prevention: Consistent handling of look-alike characters

Applied to page titles, content validation, and search queries. Matches MediaWiki's internal normalization.

Full Changelog: https://github.com/olgasafonova/mediawiki-mcp-server/compare/v1.17.5...v1.17.6

Security Fixes

  • Implemented Unicode NFC normalization to prevent bypass attacks using alternative character representations (combining characters, homoglyphs) in page titles, content, and searches.
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track olgasafonova/mediawiki-mcp-server

Get notified when new releases ship.

Sign up free

About olgasafonova/mediawiki-mcp-server

Connect to any MediaWiki wiki (Wikipedia, Fandom, corporate wikis). 33+ tools for search, read, edit, link analysis, revision history, and Markdown conversion. Supports stdio and HTTP transport.

All releases →

Related context

Earlier breaking changes

  • v1.31.0 rationale parameter now required on 7 destructive MCP tools

Beta — feedback welcome: [email protected]