Executive brief
MCP-for-Stata is a tool used to integrate the Stata statistical software with AI agents and automated workflows. A security flaw allows an attacker to bypass built-in security guards and execute unauthorized commands on the underlying system. This could lead to full system takeover, unauthorized data access, or the deletion of important files.
Technical details
A command injection vulnerability exists in MCP-for-Stata (stata-mcp) prior to version 1.17.3. The root cause is the direct interpolation of the user-supplied `log_file_name` parameter into Stata command strings using Python f-strings within `src/stata_mcp/stata/stata_do/do.py`. While the `GuardValidator` component inspects the content of do-files, it fails to validate parameters passed to the wrapper command. An attacker can use quotes, semicolons, or newlines to break out of the `log using` command context and execute arbitrary Stata commands like `shell`, `python`, or `erase`. This allows for Remote Code Execution (RCE) and path traversal. The issue is fixed in version 1.17.3 by implementing strict regex validation and path resolution checks.
Affected products
- SepineTam stata-mcp < 1.17.3
Timeline
- 2026-05-19: disclosed: Issue reported and GHSA advisory published
- 2026-07-21: advisory: CVE published to NVD
- 2026-07-21: patched: Version 1.17.3 released with fix