These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
MCP-for-Stata is vulnerable to arbitrary Stata command injection due to unsanitized user input in the `log_file_name` parameter of the `stata_do` API and CLI. This issue, patched in version 1.17.3, allows attackers to execute arbitrary Stata commands, including `shell`, `python`, and `erase`, by crafting malicious input containing quotes, newlines, or Stata command separators.
A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution. This vulnerability has a CVSS score of 9.8 and is considered CRITICAL. The CVE record was published on 2026-04-08T16:16:22.977Z and has not been modified since then. Users of stata-mcp prior to v1.13.0 should validate and update their installation [truncated]