CVE-2026-55071

Name of the Vulnerable Software and Affected Versions stata-mcp (affected versions not specified)

Description The ado package install tool concatenates user-controlled input into a Stata command string without validation or sanitization. An attacker can embed newline characters in the package variable to inject arbitrary Stata commands. Since Stata supports a shell escape command, this allows for full OS-level arbitrary command execution under the account running the server. The issue occurs because the package parameter in the install() function of SSC Install is interpolated into a string and sent verbatim to the Stata REPL via sendline(), which executes each line as a separate command. Although a blacklist exists for dangerous commands, it is not applied to the ado-install path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the ado package install tool to minimize the risk of exploitation.