CVE-2026-55071: 
Python vulnerability analysis and mitigation

CVE-2026-55071 is a Stata command injection vulnerability in the ado_package_install MCP tool of the stata-mcp (mcp-for-stata) Python package, allowing attackers to inject arbitrary Stata commands — and subsequently arbitrary OS commands — via unsanitized package input. It affects all versions of stata-mcp up to and including 1.18.2 (pip package). The vulnerability was published by SepineTam on June 10, 2026, and added to the GitHub Advisory Database on August 12, 2026. It carries a CVSS v3.1 base score of 8.4 (High) (GitHub Advisory, Security Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the SSC_Install.install() method in ssc_install.py directly interpolates the user-supplied package argument into an f-string (install_command = f"ssc install {package}{self.REPLACE_MESSAGE}") with no allowlist validation, newline rejection, or quoting. The resulting multi-line string is passed verbatim to the Stata REPL via pexpect.sendline() in controller.py, which executes each line as a separate Stata command. Because Stata's built-in shell (and !) command passes its argument to the OS shell, an attacker can embed a newline followed by shell <os-command> in the package parameter to achieve full OS-level RCE. Notably, an existing guard/blacklist (blacklist.py) that blocks shell, !, and similar commands is only enforced on the stata_do execution path and is never invoked in the ado-install path, rendering it entirely ineffective here (GitHub Advisory, Security Advisory).

Successful exploitation grants an attacker arbitrary OS command execution with the privileges of the user account running the Stata-MCP server. Because the ado_package_install tool is registered in the default all profile (which is the default active profile), no misconfiguration by the victim is required — all users running stata-mcp server on affected versions are exposed. Concrete consequences include credential and data exfiltration, establishment of persistence via cron or startup entries, lateral movement within the local network, and complete compromise of the host user account (GitHub Advisory).

A public proof-of-concept (PoC) is included in the advisory itself, including a Docker-based reproduction environment that does not require a Stata license, as well as a direct Python trigger and an MCP JSON-RPC payload. No privileges are required to exploit the vulnerability, and no user interaction is needed. There is no current evidence of in-the-wild exploitation or threat actor attribution. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV listing has been reported (GitHub Advisory, Security Advisory).

1. Identify target: Locate a system running stata-mcp server version ≤ 1.18.2 with the default all profile active (no special configuration required).
2. Choose attack vector: Select one of three available attack surfaces — direct Python API call, MCP JSON-RPC request, or HTTP client if the HTTP transport is exposed.
3. Craft the payload: Construct a malicious package argument embedding a newline character followed by a Stata shell command, e.g.:

   outreg2\nshell <os-command>\n//

   The trailing // comment neutralizes the , replace suffix appended by REPLACE_MESSAGE to avoid a Stata syntax error.
4. Deliver via MCP JSON-RPC (example):

   {
     "tool": "ado_package_install",
     "arguments": {
       "source": "ssc",
       "package": "outreg2\nshell touch /tmp/pwned\n//",
       "is_replace": true
     }
   }

5. Command execution: The f-string in ssc_install.py expands the payload into a multi-line string; pexpect.sendline() delivers it to the Stata REPL, which executes shell touch /tmp/pwned as an OS command under the server's user account.
6. Post-exploitation: Use the achieved RCE to exfiltrate data, establish persistence (e.g., add a cron job), or pivot laterally within the network (GitHub Advisory, Security Advisory).

• File System: Unexpected files created in /tmp/ (e.g., /tmp/stata_mcp_ado_poc or similar marker files); new or modified cron jobs or startup scripts owned by the Stata-MCP server's user account; unexpected scripts or binaries dropped in writable directories.
• Process: Unusual child processes spawned by the Stata process or the stata-mcp Python process (e.g., bash, sh, curl, wget, python3) with command-line arguments referencing external hosts or sensitive file paths.
• Logs: MCP server logs showing ado_package_install tool invocations with package arguments containing newline characters (\n) or shell/! substrings; Stata REPL output logs containing shell commands not initiated by legitimate user activity.
• Network: Unexpected outbound connections from the host running stata-mcp to external IPs or domains, particularly following ado_package_install tool calls (GitHub Advisory).

Upgrade stata-mcp to version 1.19.0 or later, which addresses the vulnerability through multiple hardening measures: the ado_package_install tool has been moved behind the --unsafe profile (no longer available in core or all profiles by default), an entry-point approval layer requires explicit opt-in before ado installation is usable, and alphanumeric-only package name validation is enforced to block injection via malformed names. If immediate upgrade is not possible, restrict access to the MCP server to trusted users only and avoid exposing the HTTP transport publicly. Running the Stata-MCP server with a least-privilege user account will limit the blast radius of any exploitation (v1.19.0 Release, GitHub Advisory).

The vulnerability was discovered and reported by researcher useworld (analyst: EQSTLab) and published by the repository maintainer SepineTam on June 10, 2026. The advisory was added to the GitHub Advisory Database on August 12, 2026, and detected by Qualys scanners. No significant broader media coverage or notable social media commentary has been identified beyond the official advisory (GitHub Advisory).