The vulnerability in stata‑mcp allows arbitrary command execution due to insufficient validation of user‑supplied Stata do‑file content. An attacker who can supply a malicious do‑file can cause the application to execute shell commands, potentially compromising system confidentiality, integrity, and availability. The weakness stems from a failure to sanitize or restrict executable code within user input, enabling code injection.

stata‑mcp versions earlier than 1.13.0 are affected. No specific vendor was identified; the product is the open‑source stata‑mcp tool, which is publicly available via GitHub. Systems running any pre‑1.13.0 release of this software should be reviewed for exposure.

Given the command‑execution capability, the risk is high. No CVSS score or EPSS data are provided, but the vulnerability permits full control over system commands, making exploitation straightforward if an attacker can supply a malicious do‑file. The likely attack vector is when the application processes user‑supplied content, whether from a local user or insecure remote input. As the vulnerability is not listed in the CISA KEV catalog, known exploits have not yet been reported, though the impact remains severe.