PyPI/stata-mcp CVE-2026-31040: critical 9.8, EPSS 0.57%

stata-mcp has insufficient validation of user-supplied Stata do-file content that can lead to command execution

Action: Upgrade stata-mcp to 1.13.0 or later.

pip install stata-mcp==1.13.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3076
• nvd: CVE-2026-31040
• https://github.com/SepineTam/stata-mcp/issues/20
• https://github.com/SepineTam/stata-mcp/pull/21
• https://github.com/SepineTam/stata-mcp/commit/52413ce
• https://github.com/SepineTam/stata-mcp/releases/tag/v1.13.0
• https://github.com/sepinetam/stata-mcp
• https://pypi.org/project/stata-mcp
• https://github.com/advisories/GHSA-jpcj-7wfg-mqxv

CVE-2026-31040 · published 2026-07-13T14:36:49.980423Z · modified 2026-07-13T16:33:12.969652260Z · JSON