CVE-2026-55071: MCP-for-Stata RCE Vulnerability

CVE-2026-55071 Overview

CVE-2026-55071 is a command injection vulnerability in MCP-for-Stata, a Model Context Protocol (MCP) server that integrates Stata into AI agent loops. The flaw resides in the ado_package_install MCP tool, which concatenates user-controlled input directly into a Stata command string without validation or sanitization. An attacker who can invoke the MCP tool or its equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this results in operating system-level arbitrary command execution under the account running the Stata-MCP server. The vulnerable tool is registered in the default all profile, so no non-default configuration is required to reach it.

Critical Impact

Attackers can achieve arbitrary OS command execution as the Stata-MCP server user via newline-based Stata command injection followed by Stata shell escape.

Affected Products

• MCP-for-Stata (stata-mcp) prior to version 1.19.0
• Deployments using the default all MCP tool profile
• AI agent integrations that expose the ado_package_install tool or Python API

Discovery Timeline

• 2026-09-21 - CVE-2026-55071 published to the National Vulnerability Database (NVD)
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-55071

Vulnerability Analysis

MCP-for-Stata exposes Stata functionality to large language model (LLM) agents through the Model Context Protocol. The ado_package_install tool accepts a package argument and passes it into a Stata command line intended to install ado packages. The server builds the command through direct string concatenation rather than parameter binding or allow-list validation.

This defect is classified as improper control of generated code [CWE-94]. Stata treats newline characters as command separators, so an argument containing a newline splits into two or more distinct Stata commands. Stata additionally provides a shell escape that hands execution to the underlying operating system shell. Chaining these two behaviors converts an unsanitized package name into arbitrary OS command execution.

Exploitation runs with the privileges of the account executing the Stata-MCP server. In typical developer or analyst workstations, that account has broad access to source code, data files, and cached credentials. Successful exploitation yields full confidentiality, integrity, and availability impact on the host.

Root Cause

The root cause is missing input validation on the package parameter of the ado_package_install tool. User input is embedded verbatim into a multi-line Stata script. There is no rejection of newline characters, no shell escape filtering, and no allow-list of legal package name characters.

Attack Vector

The attack requires the ability to invoke the MCP tool or the equivalent Python API. This includes any LLM agent connected to the server, any local process able to speak MCP to the endpoint, and any workflow that forwards untrusted content into the package argument. Prompt injection payloads delivered to a connected agent are a realistic delivery path. Refer to the GitHub Security Advisory GHSA-49m4-vp58-wgc9 for the vendor's technical description.

Detection Methods for CVE-2026-55071

Indicators of Compromise

• Stata process spawning unexpected child processes such as sh, bash, cmd.exe, powershell.exe, curl, or wget
• MCP request logs containing newline characters or Stata shell escape syntax inside the package argument to ado_package_install
• Outbound network connections originating from the Stata-MCP server account to unfamiliar destinations
• New cron jobs, scheduled tasks, or SSH keys created by the Stata-MCP service account

Detection Strategies

• Inspect MCP tool call telemetry for ado_package_install invocations with control characters or non-alphanumeric content in the package field
• Alert on Stata interpreters that create shell processes, since normal Stata analytical workloads rarely do this
• Correlate LLM agent transcripts with subsequent process execution on the host to catch prompt-injection driven exploitation

Monitoring Recommendations

• Log all MCP tool invocations with full argument capture and retain them for post-incident analysis
• Monitor the Stata-MCP service account for privilege changes, credential access, and lateral movement attempts
• Baseline expected child processes of the Stata binary and alert on deviations

How to Mitigate CVE-2026-55071

Immediate Actions Required

• Upgrade stata-mcp to version 1.19.0 or later, which contains the fix
• Audit MCP server configurations and disable the ado_package_install tool until the upgrade is complete
• Review recent MCP tool call logs for suspicious package arguments and investigate any matches
• Rotate credentials, tokens, and SSH keys accessible to the Stata-MCP service account if compromise is suspected

Patch Information

The maintainer released the fix in version 1.19.0. See the GitHub Release v1.19.0 notes and the GitHub Security Advisory GHSA-49m4-vp58-wgc9 for remediation details.

Workarounds

• Remove or disable the ado_package_install tool from the active MCP profile if immediate upgrade is not possible
• Restrict MCP server exposure to trusted local clients only and block remote access at the network layer
• Run the Stata-MCP server under a dedicated low-privilege account with no write access to sensitive project or credential paths
• Filter or reject any package values containing newline characters, semicolons, or shell escape prefixes at an upstream proxy

# Upgrade to the patched release
pip install --upgrade "stata-mcp>=1.19.0"