PYSEC-2026-544

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/stata-mcp/PYSEC-2026-544.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-544
Aliases
Published
2026-06-29T11:50:52Z
Modified
2026-07-01T20:23:05Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
Details

Summary

The log_file_name parameter in the stata_do API and CLI is directly interpolated into a Stata command string without sanitization. The security guard (GuardValidator) only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands (including shell, python, erase, etc.) by crafting a malicious log_file_name containing quotes, newlines, or Stata command separators.

Details

In src/stata_mcp/stata/stata_do/do.py, both _execute_unix_like and _execute_windows construct a Stata command string using Python f-strings:

commands = f"""
capture log close
{self.generate_log_command(log_file, is_replace)}
...
do "{dofile_path}"
...
"""

The generate_log_command method returns:

log_cmd = f'log using "{log_file.as_posix()}", {replace_clause} {log_type} name({log_type}_log)'

Where log_file is constructed from user-supplied log_name:

def generate_log_file(self, log_name: str, extension='log'):
    return self.log_file_path / f"{log_name}.{extension}"

The log_name parameter comes directly from user input (via MCP tool stata_do or CLI stata-mcp tool do) without any validation. Since the path is embedded inside double quotes in a Stata command string, an attacker can break out of the string context and inject arbitrary commands.

Additionally, generate_log_file does not prevent path traversal via log_name, allowing arbitrary file write outside the intended log directory.

Proof of Concept

When calling stata_do via MCP tool with:

{
  "dofile_path": "test.do",
  "log_file_name": "'; shell echo pwned > /tmp/pwned.txt; '"
}

The generated Stata commands become:

 log using "<log_dir>/'; shell echo pwned > /tmp/pwned.txt; '.log", replace text name(text_log)

Stata interprets this as multiple commands, with shell echo pwned > /tmp/pwned.txt; executed as an arbitrary shell command.

Impact

  • Remote Code Execution via shell command injection
  • Arbitrary file write/overwrite via path traversal in log_name
  • Complete bypass of the security guard, as the guard only validates do-file content, not wrapper parameters

Remediation / Fix

  1. Apply strict allowlist validation to log_name (only alphanumeric, underscore, dot, hyphen; max 128 chars)
  2. Resolve and verify the constructed log path remains within the intended log directory
  3. Consider generating safe internal filenames (e.g., UUIDs) instead of accepting user-defined log names for command construction
  4. Apply similar sanitization to dofile_path before embedding it into Stata command strings

References

References

Affected packages

PyPI / stata-mcp

Package

Name
stata-mcp
View open source insights on deps.dev
Purl
pkg:pypi/stata-mcp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.17.3

Affected versions

0.*
0.1.0
1.*
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.10
1.4.0
1.4.1
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.2
1.6.3
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.8.0
1.8.1
1.8.2
1.9.0
1.9.1
1.10.0
1.10.1
1.10.2
1.11.0
1.11.1
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.13.7
1.13.8
1.13.9
1.13.10
1.13.11
1.13.12
1.13.13
1.13.14
1.13.15
1.13.16
1.13.17
1.13.18
1.13.19
1.13.20
1.13.21
1.13.22
1.13.23
1.13.24
1.13.25
1.13.26
1.13.27
1.13.28
1.13.29
1.13.30
1.13.31
1.13.32
1.13.33
1.13.34
1.13.35
1.13.36
1.13.37
1.13.38
1.13.39
1.13.40
1.13.41
1.13.42
1.14.0
1.14.1
1.14.2
1.14.3
1.15.0
1.15.1
1.16.0
1.16.1
1.16.2
1.16.3
1.17.0
1.17.1
1.17.2

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/stata-mcp/PYSEC-2026-544.yaml"