CVE-2026-47708

Name of the Vulnerable Software and Affected Versions stata-mcp (affected versions not specified)

Description The stata do API and CLI contain a flaw where the log file name parameter is interpolated into a Stata command string without proper sanitization. This allows an attacker to break out of the string context using quotes or newlines to inject arbitrary Stata commands, such as shell, python, or erase, leading to remote code execution. Additionally, the generate log file() function does not prevent path traversal via the log name variable, which enables arbitrary file writes or overwrites outside the intended log directory. The existing security guard only validates do-file content and fails to inspect these wrapper parameters.

Recommendations Apply strict allowlist validation to log name to permit only alphanumeric characters, underscores, dots, and hyphens with a maximum length of 128 characters. Verify that the constructed log path remains within the intended log directory to prevent path traversal. Use internally generated safe filenames, such as UUIDs, instead of user-defined names for command construction. Sanitize the dofile path parameter before embedding it into Stata command strings.