Description

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this leads to full OS-level arbitrary command execution (RCE) under the account running the Stata-MCP server. The tool is registered in the default all profile, so no non-default configuration is required. This issue has been patched in version 1.19.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-21T15:17:29.450Z",
  "pubdate": "2026-09-21T15:17:29.450Z",
  "executiveSummary": "The MCP-for-Stata framework prior to version 1.19.0 contains a critical command injection vulnerability within the ado_package_install MCP tool.\nThis vulnerability stems from improper input validation, where user-supplied arguments are concatenated directly into Stata command strings without sanitization.\nThe vulnerability allows an attacker capable of invoking the MCP tool or the associated Python API to perform Remote Code Execution (RCE) at the OS level.\nBecause Stata supports shell escape sequences, the injection of newline characters allows the execution of arbitrary system commands under the security context of the user running the Stata-MCP server.\nThis represents a high-risk security flaw, as the tool is registered in the default profile, making it accessible without requiring non-default configuration changes.\nSuccessful exploitation results in full system compromise, as the attacker can execute commands with the privileges of the underlying Stata-MCP process.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of command construction within the ado_package_install function of the stata-mcp tool. The application fails to sanitize input parameters before passing them to the Stata interpreter. Specifically, the tool takes a package name as input and concatenates it into a command string intended for execution within the Stata environment.\nBecause Stata command syntax allows for the inclusion of newline characters to terminate the current instruction and initiate a new one, an attacker can inject malicious command sequences. By crafting a payload containing newline characters, the attacker can break out of the intended 'ado_package_install' command context and execute arbitrary secondary Stata commands.\nThe exploitation path leverages Stata's native functionality, specifically its shell escape command, which permits the execution of arbitrary operating system commands. By injecting a payload structure such as 'package_name\\n!system_command', the attacker forces the Stata process to spawn a child process with the context of the OS shell. Consequently, the attacker achieves arbitrary command execution (RCE) with the permissions of the Stata-MCP server process.\nThe vulnerability affects all versions of MCP-for-Stata prior to 1.19.0. It is particularly severe because the ado_package_install tool is registered by default, meaning no special configuration or escalation is required for an adversary to reach the vulnerable code path. The impact is essentially total host compromise, as the server process typically maintains sufficient filesystem and network access required for the operation of the Stata integration.\nThe attack flow proceeds as follows: 1) The attacker invokes the ado_package_install tool via the MCP interface or Python API. 2) The attacker submits a malicious string containing a newline character and shell escape sequences (e.g., 'dummy\\n!rm -rf /' or similar). 3) The backend service processes this string by concatenating it into a Stata script without validation. 4) The Stata engine interprets the injected newline as a command separator. 5) The shell escape command is executed by the OS, leading to immediate RCE."
}