External risk intelligence

MCP-for-Stata Parameter Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-47708

The vulnerability exists in an MCP (Model Context Protocol) server used to integrate Stata into AI agents. While such servers may be exposed to facilitate agent access, they are typically internal or developer-facing components rather than public-facing gateways, APIs, or edge services.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

MCP-for-Stata, a component for integrating Stata into agents, has a vulnerability where an attacker could inject malicious commands by manipulating a log file parameter. This could allow unauthorized execution of arbitrary commands within the Stata environment. The primary concern is to confirm if this specific technology is in use and if it is exposed.

Unsanitized input allows command injection.
Affects systems integrating Stata into agents.
Confirm relevance and any exposure.

Attack Path

How an attacker could exploit the issue

An attacker can trigger this vulnerability by sending a specially crafted request to the `stata_do` API or CLI. This request would exploit the `log_file_name` parameter, which is not properly validated and is directly inserted into a Stata command. If successful, an attacker could inject and execute arbitrary Stata commands, potentially leading to the execution of other commands like `shell` or `python`, or even file deletion.

No authentication or user interaction needed.
Malicious `log_file_name` parameter.
Arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject and execute arbitrary Stata commands by manipulating the `log_file_name` parameter when interacting with the `stata_do` API or CLI. This could potentially lead to unauthorized execution of system commands, file manipulation, or even code execution, depending on the permissions and environment in which the MCP server is running.

Arbitrary Stata commands could be executed.
Malicious input in `log_file_name` allows injection.
Unauthorized system command execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The `MCP-for-Stata` integration with Stata is likely managed by teams responsible for data science platforms, AI/ML development, or application integration, with the application or platform owner accountable for remediation. The first practical step is to identify all instances of `MCP-for-Stata`, confirm their reachability and business criticality, and then coordinate the upgrade to version 1.17.3 or later.

Ownership: Application or platform owners.
Verify first: Affected technology reachability and criticality.
Action: Plan and execute the upgrade to version 1.17.3+.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MCP-for-Stata?

MCP-for-Stata is a specialized server component designed to connect the Stata statistical software suite with AI agents using the Model Context Protocol. It enables agents to execute data analysis scripts, known as do-files, within a Stata environment. By bridging these two technologies, it allows automated systems to perform complex statistical modeling and data processing tasks directly through a structured API.

What is the vulnerability in CVE-2026-47708?

This vulnerability is a command injection flaw, specifically categorized as CWE-77. It occurs because the software fails to sanitize the log_file_name parameter before passing it to Stata. Because the internal security guard only checks the content of the do-file itself and ignores this parameter, an attacker can append malicious commands, including shell or system-level instructions, to the file name, which the server then executes.

How does an attacker trigger this flaw?

An attacker triggers the vulnerability by submitting a crafted request to the stata_do API or CLI containing a malicious string in the log_file_name field. By including special characters like quotes or command separators, they can break out of the intended path and inject arbitrary commands. Note that simply submitting a valid, clean file name or accessing the server without these specific malformed inputs will not trigger the command injection.

Is my system at risk for CVE-2026-47708?

Halo Surface Signal indicates this is a possible concern for systems integrating AI agents with Stata. While the software is designed to be a component for agent communication, it is often deployed in internal or developer-facing environments rather than as a public gateway. You should focus on identifying instances where this server is reachable over your network, particularly if it has been exposed to broader environments beyond local development.

How do I fix this issue?

The primary response is to update the software to version 1.17.3 or later, which includes the necessary input validation to prevent command injection. Start by auditing your environment to locate all running instances of the MCP-for-Stata component. Once identified, verify their current version and schedule an upgrade for any instance prior to 1.17.3 to ensure the log_file_name parameter is correctly sanitized.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.