{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/stata-mcp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["stata-mcp"],"_cs_severities":["high"],"_cs_tags":["rce","command-injection","stata-mcp"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Stata-MCP server is vulnerable to a command injection vulnerability (CVE-2026-55071) within the \u003ccode\u003eado_package_install\u003c/code\u003e tool, specifically in the \u003ccode\u003eSSC_Install.install()\u003c/code\u003e method. By failing to validate or sanitize the \u003ccode\u003epackage\u003c/code\u003e argument, the tool allows an attacker to inject newline characters followed by arbitrary Stata commands. Because Stata provides a native \u003ccode\u003eshell\u003c/code\u003e escape mechanism, these injected commands can be elevated to OS-level arbitrary code execution (RCE). The vulnerability is critical because the affected tool is registered in the default \u003ccode\u003eall\u003c/code\u003e profile, meaning it is exposed to any caller - including AI agents or external clients - without requiring additional configuration. The existing \u003ccode\u003eGuardValidator\u003c/code\u003e mechanism is bypassed because it is not invoked during the ado-install code path, leaving installations prior to version 1.19.0 fully exposed.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies access to the Stata-MCP server, potentially via an exposed AI-agent interface or API endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a JSON-RPC request targeting the \u003ccode\u003eado_package_install\u003c/code\u003e tool.\u003c/li\u003e\n\u003cli\u003eAttacker embeds the malicious payload into the \u003ccode\u003epackage\u003c/code\u003e argument, specifically including \u003ccode\u003e\\n\u003c/code\u003e to terminate the intended \u003ccode\u003essc install\u003c/code\u003e command.\u003c/li\u003e\n\u003cli\u003eThe Stata-MCP server receives the input and passes the unsanitized \u003ccode\u003epackage\u003c/code\u003e string directly to \u003ccode\u003eSSC_Install.install()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe method interpolates the string into a command buffer, which is subsequently passed to the \u003ccode\u003eStataController\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eStataController\u003c/code\u003e uses \u003ccode\u003epexpect.sendline()\u003c/code\u003e to write the multi-line string directly to the Stata REPL process.\u003c/li\u003e\n\u003cli\u003eThe Stata REPL executes the intended command, followed immediately by the attacker's injected \u003ccode\u003eshell\u003c/code\u003e command.\u003c/li\u003e\n\u003cli\u003eOS command execution occurs with the privileges of the system user running the Stata-MCP server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full OS-level command execution with the privileges of the Stata-MCP service user. This allows attackers to perform unauthorized data exfiltration, establish persistence on the host, move laterally within the network, or perform further local exploitation. Given the prevalence of AI agents interacting with such tools, this vulnerability poses a high risk to environments integrating Stata-MCP into automated workflows.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003estata-mcp\u003c/code\u003e to version 1.19.0 or later to patch the input sanitization flaw.\u003c/li\u003e\n\u003cli\u003eAudit logs for calls to \u003ccode\u003eado_package_install\u003c/code\u003e that contain newline characters or shell-related keywords such as \u0026quot;shell\u0026quot;, \u0026quot;!\u0026quot;, or \u0026quot;unixcmd\u0026quot;.\u003c/li\u003e\n\u003cli\u003eIsolate the Stata-MCP server process using containerization or restricted service accounts to minimize the potential impact of successful RCE.\u003c/li\u003e\n\u003cli\u003eImplement strict request validation at the MCP gateway if upgrading is not immediately possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-12T22:48:48Z","date_published":"2026-08-12T22:48:48Z","id":"https://feed.craftedsignal.io/briefs/2026-08-stata-mcp-rce/","summary":"The ado_package_install tool in stata-mcp fails to sanitize user-provided package names, allowing attackers to inject newline characters and execute arbitrary OS commands via the Stata REPL.","title":"Stata-MCP Unsanitized Package Argument Command Injection","url":"https://feed.craftedsignal.io/briefs/2026-08-stata-mcp-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Stata-Mcp","version":"https://jsonfeed.org/version/1.1"}