high · 8.4CVE-2026-55071Aug 12, 2026

CVE-2026-55071: stata-mcp Stata Command Injection via Unsanitized Package Name

Shubham Kandhare
Security Engagement Manager, SecureLayer7

The stata-mcp package lets an attacker run arbitrary operating system commands by embedding newline characters in a package name passed to the Stata package installer, because the input is never…

Packagestata-mcp
Ecosystempip
Affected< 1.19.0
Fixed in1.19.0
CVE-2026-55071: stata-mcp Stata Command Injection via Unsanitized Package Name

The problem

The ado_package_install MCP tool in stata-mcp (pip package) passes the caller-supplied package argument directly into an f-string that builds a Stata command, then sends that string verbatim to the Stata REPL via pexpect.sendline(). No allowlist, newline check, or quoting is applied.

Because Stata treats each line as a separate command, and because Stata's built-in shell command executes an OS-level command, a newline in package gives full RCE under the account running the server. The tool is active in the default all profile, so no non-default configuration is needed to reach it.

Proof of concept

A working proof-of-concept for CVE-2026-55071 in stata-mcp, with the exact payload below.

json
# MCP JSON-RPC call
{
  "tool": "ado_package_install",
  "arguments": {
    "source": "ssc",
    "package": "outreg2\nshell touch /tmp/stata_mcp_ado_poc\n//",
    "is_replace": true
  }
}

# Equivalent Python (direct API)
from stata_mcp.stata.builtin_tools.ado_install.ssc_install import SSC_Install
installer = SSC_Install("/usr/local/bin/stata", is_replace=True, timeout=10)
installer.install("outreg2\nshell touch /tmp/stata_mcp_ado_poc\n//")

# Command string delivered to Stata REPL via sendline():
# ssc install outreg2
# shell touch /tmp/stata_mcp_ado_poc   <-- OS command executed here
# //, replace                           <-- trailing comment neutralises ', replace'

The root cause is in ssc_install.py:15: install_command = f"ssc install {package}{self.REPLACE_MESSAGE}". The package value is interpolated with no sanitization, and controller.py:99 delivers it via pexpect.sendline(), which writes the full multi-line string to the Stata REPL, executing each line in sequence.

A GuardValidator blacklist (blacklist.py:41-60) does exist and flags shell, !, and related commands as dangerous, but it is only invoked on the stata_do code path. It is never called in the ado-install path, so the guard provides no protection here.

The fix, introduced in v1.19.0, adds an allowlist check that restricts SSC and net package names to ASCII letters and digits only, rejecting any input containing newlines, whitespace, or shell metacharacters before the f-string is evaluated. This maps to CWE-94 (Improper Control of Generation of Code).

The fix

Upgrade stata-mcp to version 1.19.0 or later. The patch adds an input allowlist that permits only ASCII alphanumeric characters in SSC and net package names, rejecting newlines and other injection characters before they reach the command-building f-string. Pin your dependency: pip install 'stata-mcp>=1.19.0'.

Reported by Security researcher via GHSA-49m4-vp58-wgc9 (reporter identity not publicly disclosed in advisory).

References: [1][2][3]

Related research