rootpwn

high · CVSS v3 8.4

CVE-2026-55071

MCP-for-Stata's ado_package_install tool concatenates user input into a Stata command string without sanitization, allowing attackers to inj

Overview

MCP-for-Stata's ado_package_install tool concatenates user input into a Stata command string without sanitization, allowing attackers to inject newline characters and execute arbitrary OS commands. This flaw exists in versions prior to 1.19.0 and can be triggered via the MCP tool or its Python API. The vulnerability enables full OS‑level remote code execution under the server’s user account.

Description

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent Python API can embed newline characters in the package argument to inject arbitrary Stata commands. Because Stata supports a shell escape command, this leads to full OS-level arbitrary command execution (RCE) under the account running the Stata-MCP server. The tool is registered in the default all profile, so no non-default configuration is required. This issue has been patched in version 1.19.0.

Impact

The flaw compromises confidentiality, integrity, and availability of systems running the vulnerable Stata-MCP server. Attackers can gain full control over the host OS, exfiltrate data, modify files, or disrupt services. Defenders managing Stata-MCP deployments are directly impacted.

Remediation

Upgrade MCP-for-Stata to version 1.19.0 or later, which removes the unsanitized input handling. If an upgrade is not immediately possible, restrict network access to the MCP server, disable the ado_package_install tool, or enforce strict input validation on the package argument. Monitor logs for unexpected Stata command execution.

Risk context

The vulnerability has a high severity rating (CVSS 8.4) and poses a critical risk to any environment running the affected Stata-MCP server. Immediate patching is recommended to prevent potential OS‑level compromise.

Affected products

  • MCP-for-Stata
  • Stata-MCP server
  • Stata

Scores

Severity
high
CVSS v2
7.2
CVSS v3
8.4
CVSS v4
—
EPSS
—

RCE command injection Stata MCP high severity input validation patch

← All CVEs

Related CVEs

high

CVE-2026-94144

A high‑severity SQL injection flaw exists in drogonframework’s ORM component, allowing remote attackers to inject arbitrary SQL via the makeCriteria function. The vulnerability is present in all drogon releases up to 1.9.13 and has been publicly exploited. Defenders should immediately update or patch the framework to mitigate the risk.

View analysis

high

CVE-2026-55074

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.

View analysis

high

CVE-2026-55567

BleachBit versions prior to 6.0.1 allow a local unprivileged user on Windows to delete arbitrary files with elevated privileges by manipulating junctions and symlinks. The flaw can be leveraged to gain SYSTEM rights through Windows Installer behavior. It affects any Windows system running BleachBit before the 6.0.1 release.

View analysis

high

CVE-2026-61628

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauthenticated attacker who can reach an instance in its pre-onboarding state can create an administrator account for themselves — and concurrent requests can create multiple admin accounts in a single race. Version 2.41.1 patches the issue.

View analysis