CVE-2026-47708: MCP-for-Stata RCE Vulnerability

CVE-2026-47708 Overview

CVE-2026-47708 is a command injection vulnerability [CWE-77] in MCP-for-Stata, a Model Context Protocol (MCP) server that integrates the Stata statistical software into agent-based workflows. Versions prior to 1.17.3 interpolate the log_file_name parameter of the stata_do API and command line interface directly into a Stata command string without sanitization. The built-in GuardValidator only inspects do-file content and skips this parameter. Attackers can supply a crafted log_file_name containing quotes, newlines, or Stata command separators to inject arbitrary Stata commands, including shell, python, and erase. Version 1.17.3 introduces input validation that patches the flaw.

Critical Impact
Unauthenticated network-reachable attackers can execute arbitrary Stata and operating system commands on the host running MCP-for-Stata, compromising confidentiality, integrity, and availability.

Affected Products

MCP-for-Stata versions prior to 1.17.3
Stata integrations exposing the stata_do API endpoint
Stata integrations exposing the stata_do CLI command

Discovery Timeline

2026-07-21 - CVE-2026-47708 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47708

Vulnerability Analysis

MCP-for-Stata exposes a stata_do operation that executes user-supplied do-files against a Stata backend. The operation accepts a log_file_name argument used to name the Stata log output. That value is embedded directly into a Stata command string that is then handed to the Stata interpreter.

The project ships a security control named GuardValidator intended to block dangerous Stata commands such as shell, python, and erase. However, GuardValidator only inspects the body of the submitted do-file. It does not evaluate log_file_name, leaving a validation gap around a parameter that flows into the same interpreter.

Because the interpolated command string is a Stata directive, an attacker can terminate the intended log using statement using quote characters, newlines, or Stata statement separators, then append arbitrary commands. This produces reliable command injection reachable over the network without authentication or user interaction.

Root Cause

The root cause is missing input validation on the log_file_name parameter combined with string interpolation into a command interpreter. The security guard operated on the wrong scope, treating log filenames as inert data while the underlying code treated them as executable syntax.

Attack Vector

An attacker sends a request to the stata_do API, or invokes the CLI, supplying a log_file_name value that includes Stata command separators and follow-on commands such as shell or erase. When the server builds and executes the Stata command string, the injected payload runs in the context of the MCP-for-Stata process.

python

# Security patch from src/stata_mcp/stata/stata_do/do.py
# fix: validate log_file_name to prevent Stata command injection
import logging
import os
import re
import subprocess
import tempfile
from pathlib import Path
from typing import Dict, List, Literal, Optional

from ...utils import get_nowtime

LOG_FILE_NAME_PATTERN = re.compile(r"^[A-Za-z0-9_.-]{1,128}$")


class StataDo:
    def __init__(self,
        ...

Source: GitHub Commit e6f9459

The patch introduces LOG_FILE_NAME_PATTERN, a strict allow-list regular expression permitting only alphanumeric characters, underscores, dots, and hyphens with a maximum length of 128 characters. Values outside this pattern are rejected before reaching the Stata interpreter.

Detection Methods for CVE-2026-47708

Indicators of Compromise

Requests to the stata_do API where the log_file_name field contains quote characters, backticks, newlines, semicolons, or the Stata separator ///.
Presence of Stata commands such as shell, python, !, or erase inside values submitted as log_file_name.
Unexpected child processes spawned by the MCP-for-Stata service, particularly shells or interpreters not tied to normal do-file execution.
New or modified files in directories outside the configured Stata working directory following stata_do invocations.

Detection Strategies

Instrument the MCP-for-Stata service to log the raw log_file_name value received in every request and alert when the value does not match the allow-list pattern ^[A-Za-z0-9_.-]{1,128}$.
Correlate stata_do invocations with process creation events on the host to surface unexpected sh, bash, cmd.exe, or python executions parented by the MCP server.
Review Stata log files for entries containing commands that were never present in the submitted do-file body.

Monitoring Recommendations

Forward MCP-for-Stata application logs, host process telemetry, and outbound network connections into a centralized analytics platform for correlation.
Baseline normal stata_do request patterns and alert on deviations in parameter shape, length, or character set.
Monitor filesystem writes and deletions performed by the MCP-for-Stata service account, since erase is one of the injectable commands.

How to Mitigate CVE-2026-47708

Immediate Actions Required

Upgrade MCP-for-Stata to version 1.17.3 or later, which validates log_file_name against a strict allow-list.
Restrict network access to the stata_do API so that only trusted agents and services can reach it.
Audit historical request logs for prior exploitation attempts targeting the log_file_name parameter.

Patch Information

Version 1.17.3 contains the fix. The patch adds the LOG_FILE_NAME_PATTERN regular expression in src/stata_mcp/stata/stata_do/do.py and enforces it before the value is interpolated into any Stata command. See the GitHub Security Advisory GHSA-4p62-hqp5-g644, the remediation commit, and the issue discussion for full technical context.

Workarounds

If patching is not immediately possible, place the MCP-for-Stata service behind a proxy that validates log_file_name against ^[A-Za-z0-9_.-]{1,128}$ and rejects non-conforming requests.
Run the MCP-for-Stata process under a least-privilege service account with no shell access and restricted filesystem permissions to limit the impact of successful injection.
Disable or firewall the stata_do CLI and API on production hosts until the upgrade is applied.

bash

# Validate installed version and upgrade to the patched release
pip show mcp-for-stata | grep -i version
pip install --upgrade "mcp-for-stata>=1.17.3"