CVE-2026-31040 - Vulnerability Analysis

Overview

stata-mcp < 1.13.0 contains a command injection caused by insufficient validation of user-supplied Stata do-file content, letting attackers execute arbitrary commands, exploit requires crafted do-file input.

Severity & Score

Impact

Attackers can execute arbitrary commands, potentially leading to full system compromise.

Mitigation

Update to version 1.13.0 or later.

References

• https://github.com/SepineTam/stata-mcp/commit/52413ce
• https://github.com/SepineTam/stata-mcp/issues/20
• https://github.com/SepineTam/stata-mcp/pull/21
• https://github.com/SepineTam/stata-mcp/releases/tag/v1.13.0

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner