Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a command injection flaw in the stata-mcp package, specifically within the StataDo class. The root cause is the lack of sanitization for the log_file_name parameter, which is provided by the user. The execute_dofile method takes this input and uses it to construct a log file path. This is done insecurely by the generate_log_file function. The resulting path, which can contain malicious payloads, is then embedded into a Stata command string by the generate_log_command function. An attacker can craft a log_file_name with quotes and command separators (e.g., '; shell pwned; ') to break out of the intended command and inject arbitrary Stata commands. Finally, the _execute_unix_like or _execute_windows methods execute the crafted script, leading to remote code execution. The patch mitigates this by introducing a validation function, _validate_log_name, which strictly controls the allowed characters and format for the log_file_name.
StataDo.execute_dofilesrc/stata_mcp/stata/stata_do/do.py
StataDo.generate_log_filesrc/stata_mcp/stata/stata_do/do.py
StataDo.generate_log_commandsrc/stata_mcp/stata/stata_do/do.py
StataDo._execute_unix_likesrc/stata_mcp/stata/stata_do/do.py
StataDo._execute_windowssrc/stata_mcp/stata/stata_do/do.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| stata-mcp | pip | < 1.17.3 | 1.17.3 |