How the attack works
The stata_do tool builds a Stata command like log using "<log_file_name>", ... by directly inserting whatever value it receives for log_file_name (also called log_name). An attacker supplies a value that closes the quote early, or inserts a newline, then appends a Stata command such as shell, python, erase, winexec, or a ! shell-escape. Because the existing content scanner (GuardValidator) only inspects the do-file body and not this wrapper parameter, the injected command passes through unchecked. A separate variant uses ../ path segments in the same parameter to write files outside the log directory instead of injecting a command.
Why it matters
An attacker can achieve remote code execution on the machine running Stata, or overwrite/create arbitrary files outside the intended log directory, using nothing but a crafted filename parameter.
What you can do
- Validate and sanitize the log_file_name/log_name parameter separately from do-file content — reject quotes, newlines, and shell/Stata command tokens.
- Restrict log_file_name to a safe character set (alphanumeric, dash, underscore) and reject any path-traversal segments like ../.
- Run the stata_do tool with the least privilege necessary, and restrict its filesystem write access to a dedicated log directory.
- Review or update any content-scanning tool (like GuardValidator) so it also inspects wrapper parameters, not just do-file bodies.
Known benign look-alikes
- A log_file_name value that legitimately contains a single quote as part of a project naming convention but no command token follows.
- Security advisory or PR text quoting the CVE-2026-47708 payload.
- A stata_do call with a plain alphanumeric log_file_name and no quote/newline breakout.