Tag
The ado_package_install tool in stata-mcp fails to sanitize user-provided package names, allowing attackers to inject newline characters and execute arbitrary OS commands via the Stata REPL.