PyPI/stata-mcp CVE-2026-47708: unknown, EPSS 0.38%

MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

Action: Upgrade stata-mcp to 1.17.3 or later.

pip install stata-mcp==1.17.3

Affected

Fixed versions

Sources

• osv: PYSEC-2026-544
• https://github.com/SepineTam/stata-mcp/security/advisories/GHSA-4p62-hqp5-g644
• https://github.com/SepineTam/mcp-for-stata/issues/74
• https://github.com/SepineTam/mcp-for-stata/commit/e6f945941ae0c7cf5e74a428e0b3dc82b396382f
• https://github.com/SepineTam/stata-mcp
• https://pypi.org/project/stata-mcp
• https://github.com/advisories/GHSA-4p62-hqp5-g644
• https://nvd.nist.gov/vuln/detail/CVE-2026-47708

CVE-2026-47708 · published 2026-06-29T11:50:52.497266Z · modified 2026-07-01T20:23:05.367908Z · JSON