CVE-2026-47708
This vulnerability allows attackers to inject arbitrary Stata commands into the MCP-for-Stata server by manipulating the log_file_name parameter. It exists in versions before 1.17.3 and can lead to remote code execution. A patch is available in version 1.17.3.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
MCP-for-Stata server for Stata, versions prior to 1.17.3. Typical users are organizations that integrate Stata into an agent via MCP.
Real-world impact
An attacker could run arbitrary Stata commands, including shell or python, potentially executing code on the server, deleting files, or compromising the system.
Why this severity
The CVSS score of 9.3 reflects the high impact of the vulnerability: it allows remote attackers to execute arbitrary commands with no authentication or user interaction, giving them full control over the affected system.
What to do about it
- 01Upgrade MCP-for-Stata to version 1.17.3 or later.
- 02Restart the MCP server to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.