CVE-2026-55071

MCP-for-Stata (stata-mcp), a Python MCP server for integrating Stata into AI agent loops, contains a command injection in its ado_package_install tool. The package argument is interpolated into an f-string in SSC_Install.install() with no sanitization, allowing newline-delimited payloads to injec...

CVE-2026-55071

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:03+00:00| published-proof-of-concept| https://github.com/SepineTam/mcp-for-stata/security/advisories/GHSA-49m4-vp58-wgc9...