CVE-2026-31040 Details
Description
A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.
A command injection vulnerability has been identified in Stata-MCP versions prior to 1.13.0. This issue arises from inadequate validation of user-supplied Stata do-file content, which can lead to unauthorized command execution. The vulnerability is present in the 'stata_do' tool, where user-provided do-files are executed directly using 'subprocess.Popen' with 'shell=True'. This allows Stata's shell-escape directives, such as '!cmd' and 'shell cmd', to be interpreted as real operating system commands on macOS and Linux, resulting in remote code execution on the host where the MCP server is running.
Users are advised to update to Stata-MCP version 1.13.0 or later, where this vulnerability has been addressed. In the updated version, an initial guard has been added to block Stata shell-escape directives, preventing potential command injection.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SepineTam/stata-mcp/issues/20 | CISA-ADP | Issue TrackingVendor Advisory |
| https://github.com/SepineTam/stata-mcp/commit/52413ce | [email protected] | Patch |
| https://github.com/SepineTam/stata-mcp/issues/20 | [email protected] | Issue TrackingVendor Advisory |
| https://github.com/SepineTam/stata-mcp/pull/21 | [email protected] | Issue Tracking |
| https://github.com/SepineTam/stata-mcp/releases/tag/v1.13.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| statamcp stata-mcp | < 1.13.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | CVE Modified | CISA-ADP |
| Apr 8, 2026 | New CVE Received | [email protected] |