Critical severityNVD Advisory· Published Jul 21, 2026· Updated Jul 23, 2026
CVE-2026-47708
CVE-2026-47708
Description
MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the log_file_name parameter in the stata_do API and CLI is directly interpolated into a Stata command string without sanitization. The security guard (GuardValidator) only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands (including shell, python, erase, etc.) by crafting a malicious log_file_name containing quotes, newlines, or Stata command separators. Version 1.17.3 contains a patch for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
stata-mcpPyPI | < 1.17.3 | 1.17.3 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-4p62-hqp5-g644ghsaADVISORY
- github.com/SepineTam/mcp-for-stata/commit/e6f945941ae0c7cf5e74a428e0b3dc82b396382fnvdWEB
- github.com/SepineTam/mcp-for-stata/issues/74nvdWEB
- github.com/SepineTam/stata-mcp/security/advisories/GHSA-4p62-hqp5-g644ghsaWEB
- github.com/SepineTam/mcp-for-stata/security/advisories/GHSA-4p62-hqp5-g644nvd
News mentions
0No linked articles in our index yet.