Command Injection Vulnerability in MCP-for-Stata by SepineTam

CVE-2026-47708

What is CVE-2026-47708?

The MCP-for-Stata product contains a vulnerability in the log_file_name parameter used in the stata_do API and command-line interface. Prior to version 1.17.3, this parameter is interpolated directly into a Stata command string without proper sanitization, allowing an attacker to inject malicious Stata commands. This can lead to arbitrary code execution, as the security mechanism only scans the content of the do-file but neglects to validate this parameter. As a result, attackers can craft log_file_name inputs that exploit this flaw by using characters such as quotes or newlines, ultimately executing untrusted code on the system.

References