What happened
Published 2026-09-21 with CISA SSVC marking exploitation status 'poc'. The tool is registered in the default profile so no non-default config is needed, and can be reached through an agent loop (prompt-induced tool call) as well as direct API invocation.
Why it matters
A 'safety-first' research MCP server turns a low-trust agent conversation into arbitrary OS command execution on the analyst's machine — the classic MCP tool-permission blast radius amplified by prompt injection.
Attack vector
The ado_package_install MCP tool concatenates user-controlled package input directly into a Stata command string without validation. Newline injection allows arbitrary Stata commands; because Stata exposes a shell-escape command, this escalates to full OS-level RCE under the account running the Stata-MCP server.
Affected systems
SepineTam/mcp-for-stata < 1.19.0
Mitigation
Upgrade to v1.19.0 (GHSA-49m4-vp58-wgc9); restrict MCP tool exposure while patching.