CVE-2026-47708: 
Python 脆弱性の分析と軽減

CVE-2026-47708 is a command injection vulnerability in the stata-mcp Python package (MCP-for-Stata) that allows unauthenticated remote attackers to execute arbitrary Stata and shell commands by supplying a malicious log_file_name parameter to the stata_do API or CLI. The vulnerability affects all versions of stata-mcp prior to 1.17.3 and was disclosed by the project maintainer (SepineTam) on May 19, 2026, with the advisory published to the GitHub Advisory Database on June 4, 2026. It carries a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory).

The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command — Command Injection). In src/stata_mcp/stata/stata_do/do.py, both _execute_unix_like and _execute_windows construct a Stata command string using Python f-strings, directly embedding the user-supplied log_name value into a log using "<path>" Stata command without any sanitization or validation. Because the path is wrapped in double quotes within the Stata command string, an attacker can break out of the string context using single quotes, semicolons, or newlines to inject arbitrary Stata commands (e.g., shell, python, erase). The existing GuardValidator security control only inspects do-file content and does not validate the log_file_name parameter, leaving this injection vector completely unguarded. Additionally, the generate_log_file method does not prevent path traversal, enabling writes to arbitrary filesystem locations (GitHub Advisory, GitHub Issue #74).

Successful exploitation enables unauthenticated remote code execution on the host running the stata-mcp service, including execution of arbitrary OS shell commands via Stata's shell command. Attackers can also perform arbitrary file writes or overwrites anywhere on the filesystem via path traversal in the log_name parameter, potentially enabling persistence (e.g., writing to cron directories) or data destruction. The security guard is completely bypassed, meaning no existing in-application control mitigates this attack path (GitHub Advisory, GitHub Issue #74).

1. Identify target: Locate a host running stata-mcp (pip package stata-mcp < 1.17.3) with the MCP API or CLI accessible over the network.
2. Craft malicious payload: Construct a stata_do API call with a malicious log_file_name parameter containing Stata command separators, e.g.:

{
  "dofile_path": "test.do",
  "log_file_name": "'; shell echo pwned > /tmp/pwned.txt; '"
}

3. Trigger injection: Submit the crafted request to the stata_do MCP tool endpoint or CLI. The server constructs the following Stata command string without sanitization:

log using "'/; shell echo pwned > /tmp/pwned.txt; '.log", replace text name(text_log)

4. Achieve code execution: Stata interprets the injected shell echo pwned > /tmp/pwned.txt as a separate command and executes it as an OS shell command, writing attacker-controlled content to the filesystem.
5. Escalate or persist: Use the shell command to download and execute a reverse shell, or exploit path traversal (e.g., log_file_name: "../../etc/cron.d/malicious") to write files outside the intended log directory for persistence (GitHub Advisory, GitHub Issue #74).

• Network: Unexpected or anomalous API calls to the stata_do MCP endpoint with log_file_name values containing special characters such as single quotes ('), semicolons (;), newlines, or path separators (/, ..).
• File System: Unexpected files created in /tmp/ or other world-writable directories by the Stata process; log files written outside the configured log directory; new or modified files in cron directories (e.g., /etc/cron.d/) owned by the Stata service account.
• Logs: Application logs showing ValueError exceptions for invalid log_file_name (post-patch, indicating attempted exploitation); Stata execution logs containing shell or python commands not originating from legitimate do-files.
• Process: Unexpected child processes spawned by the Stata process (e.g., /bin/sh, bash, curl, wget, python) with command-line arguments reflecting injected payloads (GitHub Advisory, GitHub Issue #74).

Upgrade the stata-mcp pip package to version 1.17.3 or later, which introduces strict allowlist validation for log_file_name (only A-Z, a-z, 0-9, _, ., -; max 128 characters) and rejects path traversal attempts. The fix was implemented in commit e6f9459. As a workaround for environments that cannot immediately upgrade, restrict network access to the stata_do API/CLI endpoint and validate log_file_name input at the application or API gateway layer before it reaches the stata-mcp service (GitHub Advisory, Fix Commit).