CVE-2026-47708

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the "logfilename" parameter in the "statado" API and CLI is directly interpolated into a Stata command string without sanitization. The security guard "GuardValidator" only scans the do-file conten...

CVE-2026-47708: Improper Neutralization of Special Elements used in a Command

MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the logfilename parameter in the statado API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do-file content but...