CVE-2026-55071 in mcp-for-stata
Summary
by MITRE • 09/21/2026
MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this leads to full OS-level arbitrary command execution (RCE) under the account running the Stata-MCP server. The tool is registered in the default all profile, so no non-default configuration is required. This issue has been patched in version 1.19.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in MCP-for-Stata prior to version 1.19.0 represents a critical server-side command injection flaw that stems from improper input validation and sanitization mechanisms within the ado_package_install tool. This component, designed to integrate Stata statistical software into agent loops via an Model Context Protocol (MCP) interface, accepts user-controlled input for package installation arguments without performing adequate checks on special characters or structural integrity of the data. The core technical flaw lies in the direct concatenation of this unsanitized input into a Stata command string that is subsequently executed by the underlying system. Because the tool is registered in the default all profile, it requires no specialized configuration to be accessible, thereby expanding the attack surface significantly and allowing any authenticated user or automated agent with access to the MCP server to exploit this weakness without additional prerequisites.
The operational mechanism of the exploitation involves an attacker injecting newline characters into the package argument field. In many command-line interfaces and scripting environments, including Stata's execution context, newlines serve as delimiters for separate commands. By inserting these control characters, an adversary can effectively break out of the intended parameter scope and append arbitrary Stata commands to the original invocation string. This technique allows for the injection of complex payloads that leverage Stata’s built-in shell escape capabilities. Once the malicious command sequence is parsed by the interpreter, it bypasses any sandboxing or isolation measures inherent in standard data processing tasks, leading directly to full operating system-level arbitrary code execution under the privileges of the account running the Stata-MCP server process.
The impact of this vulnerability is severe, resulting in complete compromise of the host environment where the MCP-for-Stata service resides. An attacker achieving remote command injection can execute any OS commands supported by the underlying shell, including reading sensitive configuration files, exfiltrating data stored within the Stata workspace or associated databases, installing backdoors for persistent access, and pivoting to other systems on the network if lateral movement is possible from that account level. This aligns with Common Weakness Enumeration (CWE) category CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. Furthermore, within the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Execution via Remote Services and potentially Defense Evasion if attackers use obfuscated payloads to bypass logging or security monitoring tools.
Mitigation for this issue has been addressed in version 1.19.0 of MCP-for-Stata through rigorous input validation and sanitization protocols that prevent the injection of control characters such as newlines into command strings. Organizations utilizing earlier versions must immediately upgrade to the patched release to eliminate the risk of arbitrary code execution. In addition to upgrading, administrators should implement defense-in-depth strategies including principle of least privilege by ensuring the Stata-MCP server runs under a restricted service account with minimal OS permissions, thereby limiting the potential blast radius in case of future vulnerabilities. Network segmentation and strict access controls on MCP endpoints further reduce exposure, while continuous monitoring for anomalous command execution patterns can aid in early detection of exploitation attempts targeting similar injection flaws in other integrated tools.