Mcp For Stata
Approved changes feed: RSS · Atom
cpe:2.3:a:sepinetam:mcp-for-stata:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sepinetam (704d432b-b258-5f7a-9401-87ef006290c4) |
|---|---|
| Product | Mcp For Stata (125cb880-a85e-524c-a735-bc1b7756e7ba) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-55071 |
vulnerable | 2026-10-13 12:28:58.382276 |
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
HIGH (8.4)
MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this leads to full OS-level arbitrary command execution (RCE) under the account running the Stata-MCP server. The tool is registered in the default all profile, so no non-default configuration is required. This issue has been patched in version 1.19.0.
Published: 2026-09-21T14:09:30.169Z
Updated: 2026-09-21T14:56:37.752Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.