stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution
Date: 2026-04
Affected: pip/stata-mcp
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-31040
CWE: CWE-20

A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.


Mitigations:

Architectural layers (MAESTRO):