Showing 3 vulnerabilities on this page for stata-mcp

Signals CISA KEV Ransomware Nuclei
PyPI vulnerability results
VulnerabilityTitle and contextCVSSEPSSPoCsSignalsSTIX action

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

## Stata Command Injection via Unsanitized `package` in `ado_package_install` ### Summary The `ado_package_install` MCP tool in `stata-mcp` concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the `package` argument to inject arbitrary Stata commands. Because Stata supports a `shell` escape command, this leads to full OS-level arbitrary

CWE-94Aug 12, 2026
CVSS-v3.1EPSS-PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directly interpolated into a Stata command string without sanitization. The security guard (`GuardValidator`) only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands (including `shell`, `python`, `erase`, etc.) by crafting a malicious `log_file_name` containing quotes, newlin

CWE-77Jul 21, 2026
CVSS9.3v4.0EPSS0.302%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX

stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.

CWE-20CWE-94Apr 8, 2026
CVSS-v4.0EPSS0.557%PoCs0SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templatesSTIX