stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

CRITICAL 9.8CVE-2026-31040 · GHSA-jpcj-7wfg-mqxv · PYSEC-2026-3076 · Published 08/04/2026 · updated 25/07/2026

Package	Affected versions	Patched versions
stata-mcp PyPI	`< 1.13.0`	`1.13.0`
stata-mcp statamcp	`< 1.13.0`	`1.13.0`

Description

A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.

NVD description

A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.

References

nvd.nist.gov/vuln/detail/CVE-2026-31040 · ADVISORY
SepineTam/stata-mcp · WEB
SepineTam/stata-mcp#21 · WEB
SepineTam/stata-mcp commit 52413ce · WEB
SepineTam/stata-mcp release v1.13.0 · WEB
sepinetam/stata-mcp · PACKAGE
pypi.org/project/stata-mcp · PACKAGE
GitHub Advisory GHSA-jpcj-7wfg-mqxv · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free