THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-49m4-vp58-wgc9 (high) — MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

[GHSA] GHSA-49m4-vp58-wgc9 (high) — MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

medgithub_advisoriesPublished 2026-08-12

GHSA-49m4-vp58-wgc9 Severity: high CVE: CVE-2026-55071

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

## Stata Command Injection via Unsanitized `package` in `ado_package_install`

### Summary

The `ado_package_install` MCP tool in `stata-mcp` concatenates user-controlled input directly into a Stata command string without any validation or sanitization.

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-55071cve

Original source: https://github.com/advisories/GHSA-49m4-vp58-wgc9