Is CVE-2026-31040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-31040 being exploited in the wild.

How severe is CVE-2026-31040?

Critical severity, with a CVSS score of 9.8, published 8 April 2026.

Which products and versions are affected?

stata-mcp (PyPI) ECOSYSTEM:introduced=0,fixed=1.13.0.

Is there a fix for CVE-2026-31040?

Yes. stata-mcp (PyPI): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-31040 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-31040?

Check whether you run stata-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-31040: SepineTam stata-mcp code injection via Stata do-file shell-escape

CVE-2026-31040 · Severity: critical · CVSS 9.8 · Published 2026-04-08

stata-mcp, a tool used to integrate Stata data analysis software with other platforms, contains a security flaw that allows for unauthorized command execution. By providing a specially crafted Stata script (do-file), an attacker can bypass security checks to run arbitrary commands on the underlying operating system. This could lead to a complete system takeover, unauthorized data access, or service disruption.

Technologies: stata-mcp (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-31040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-31040 being exploited in the wild.
How severe is CVE-2026-31040?: Critical severity, with a CVSS score of 9.8, published 8 April 2026.
Which products and versions are affected?: stata-mcp (PyPI) ECOSYSTEM:introduced=0,fixed=1.13.0.
Is there a fix for CVE-2026-31040?: Yes. stata-mcp (PyPI): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-31040 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-31040?: Check whether you run stata-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

stata-mcp (PyPI): upgrade to 1.13.0 or later
```
pip install "stata-mcp>=1.13.0"
```

Technical details

A code injection vulnerability (CWE-94) exists in stata-mcp prior to version 1.13.0 due to insufficient validation of user-supplied Stata do-file content. The software failed to block Stata shell-escape directives, such as '!cmd' or 'shell cmd', which allow the Stata interpreter to execute commands directly on the host operating system. An attacker can exploit this by submitting a do-file containing these dangerous tokens, leading to arbitrary command execution with the privileges of the application. The issue was addressed in version 1.13.0 by implementing a validation guard in 'src/stata_mcp/core/stata/stata_do/do.py' that rejects files containing shell-escape sequences.

Affected products

SepineTam stata-mcp prior to v1.13.0

Identifiers

CVE-2026-31040
GHSA-jpcj-7wfg-mqxv
PYSEC-2026-3076

Timeline

2025-11-20: patched: Fix merged and version v1.13.0 released
2026-04-08: advisory: CVE-2026-31040 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.