CVE-2026-55071

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-55071 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

EUVD-2026-83921

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-55071

MCP-for-Stata (stata-mcp), a Python MCP server for integrating Stata into AI agent loops, contains a command injection in its ado_package_install tool. The package argument is interpolated into an f-string in SSC_Install.install() with no sanitization, allowing newline-delimited payloads to injec...

CVE-2026-55071 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-55071 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

CVE-2026-55071: Improper Control of Generation of Code

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

PYSEC-2026-3700 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

Stata Command Injection via Unsanitized package in adopackageinstall Summary The adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python...

CVE-2026-55071

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:03+00:00| published-proof-of-concept| https://github.com/SepineTam/mcp-for-stata/security/advisories/GHSA-49m4-vp58-wgc9...

CVE-2026-47708: Improper Neutralization of Special Elements used in a Command

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but...