Summary
MCP-for-Stata can allow arbitrary Stata commands to be injected through the ado_package_install tool when package input is inserted into a command string without validation. An attacker who can invoke the MCP tool or equivalent Python API may use this behavior to execute operating-system commands under the account running the Stata-MCP server.
Affected context
The vulnerability occurs in deployments where the ado_package_install MCP tool is enabled and accepts attacker-influenced package names or arguments. The risk is increased because the tool is available in the default all profile, and Stata supports shell escape functionality that can turn injected Stata commands into operating-system command execution.
Exploit preconditions
- Attack surface: The
ado_package_installMCP tool or its equivalent Python API - Required access: Permission to invoke the exposed MCP tool or API
- Trigger point: Construction and execution of the Stata command used for package installation
- Why exploitation is possible: User-controlled input is concatenated into a command string without adequate validation, allowing command separators such as newline characters to introduce additional Stata commands
Why this happens
The underlying bug is command injection caused by treating untrusted input as part of an executable Stata command. The tool constructs a command through direct string concatenation rather than representing package names as constrained data or invoking a parameterized interface. Because Stata can invoke shell commands, injected Stata syntax may cross the boundary from application-level input to operating-system execution, mapping to CWE-94: Improper Control of Generation of Code ('Code Injection').
Potential impact
- An attacker may execute arbitrary Stata commands
- The attacker could execute operating-system commands with the server process's privileges
- Application data and analysis workflows may be altered or exposed
- Credentials, files, or connected services may be accessed depending on runtime permissions
- The host or surrounding environment could be used for further compromise
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from being interpreted as command syntax.
Common defensive patterns include:
- Use structured, parameterized APIs or narrowly scoped library calls instead of command-string concatenation
- Apply strict allowlist validation for package identifiers and reject control characters, delimiters, and unexpected syntax
- Keep package installation separate from arbitrary command execution and disable shell escape functionality where it is not required
- Restrict which MCP tools and profiles are exposed to untrusted agents
- Run the server with a dedicated low-privilege account, minimal filesystem access, and tightly scoped network permissions
- Treat equivalent Python API entry points as the same security boundary and apply consistent validation
How teams detect issues like this
Detection approaches commonly include:
- Static analysis for string concatenation or interpolation followed by Stata command execution
- Code review checks for newline, delimiter, and control-character handling in tool arguments
- Tests that submit boundary characters and verify that input remains data rather than executable syntax
- Policy enforcement requiring allowlisted package-name formats and prohibiting shell escape behavior in service contexts
- Runtime monitoring for unexpected child processes, shell invocations, or command activity initiated by the Stata-MCP account
- Automated security review tools that flag command construction from untrusted MCP or API parameters
