MCP‑for‑Stata is a server that integrates Stata into an agent. Prior to version 1.17.3, the log_file_name parameter in the stata_do API and CLI is directly interpolated into a Stata command string without sanitization. The security guard GuardValidator only scans the do‑file content but does not validate this parameter. An attacker can inject arbitrary Stata commands—including shell, python, erase, and others—by crafting a malicious log_file_name containing quotes, newlines, or Stata command separators. The injected commands are executed by the server, giving the attacker the ability to run arbitrary system commands on the host and compromise confidentiality, integrity, and availability. The issue is fixed in version 1.17.3 with input validation for log_file_name.

The vulnerability affects all installations of SepineTam’s MCP‑for‑Stata prior to version 1.17.3. Any instance that accepts external log_file_name input—whether through the public API or the command‑line interface—remains susceptible. The patch was introduced in version 1.17.3, which validates and sanitizes the log_file_name parameter.

The CVSS score of 9.3 classifies this as a critical vulnerability, while the EPSS score of less than 1% indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote if the MCP server is reachable from an untrusted network; a local attacker with access to the agent could also exploit the flaw by invoking the CLI with a crafted log_file_name. Successful exploitation requires the attacker to supply a malicious log_file_name value through the vulnerable interface; the server then executes the embedded Stata commands without validation, allowing arbitrary system command execution.