Remote Code Execution Vulnerability in MCP-for-Stata by SepineTam
CVE-2026-55071

8.4HIGH

Key Information:

Vendor

Sepinetam

Status
Mcp-for-stata
Vendor
CVE Published:
21 September 2026

What is CVE-2026-55071?

The MCP-for-Stata tool, designed for integrating Stata into agent loops, has a serious vulnerability prior to version 1.19.0. The ado_package_install MCP tool improperly concatenates user input into a Stata command string without applying necessary validation or sanitization. This imperfection allows attackers to exploit the input by embedding newline characters, which can lead to the injection of arbitrary Stata commands. As Stata supports a shell escape command, successful exploitation could enable full OS-level arbitrary command execution under the Stata-MCP server's running account. Furthermore, the tool is registered in the default all profile, necessitating no additional configuration from users. The vulnerability has been addressed in version 1.19.0.

Affected Version(s)

mcp-for-stata < 1.19.0

References

https://github.com/SepineTam/mcp-for-stata/security/advis...
x_refsource_CONFIRM
https://github.com/SepineTam/mcp-for-stata/releases/tag/v...
x_refsource_MISC

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.