Executive brief
A vulnerability in the stata-mcp tool allows an attacker to execute arbitrary operating system commands on the server running the software. This tool is used to integrate Stata, a statistical software package, with other applications. An exploit could lead to full system compromise, unauthorized access to sensitive data, and the ability to use the server for further attacks.
Technical details
The `ado_package_install` MCP tool in `stata-mcp` fails to sanitize the `package` argument before concatenating it into a Stata command string. Specifically, `SSC_Install.install()` interpolates user input into an f-string that is subsequently passed to the Stata REPL via `pexpect.sendline()`. An attacker can inject newline characters followed by Stata's `shell` or `!` commands to execute arbitrary OS-level commands. While a blacklist guard exists for dangerous commands, it is only applied to the `stata_do` path and does not protect the `ado-install` path. This vulnerability allows any principal capable of invoking the MCP tool—including AI agents or remote clients—to achieve Remote Code Execution (RCE) with the privileges of the Stata-MCP server process.
Affected products
- stata-mcp stata-mcp
Timeline
- 2026-08-12: advisory: Advisory published on GitHub