MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)
A tool that lets AI agents run Stata commands has a bug: the name it gives to a log file gets pasted straight into a Stata command without checks. An attacker can hide extra commands or file-path tricks inside that filename to run arbitrary code or write files outside the intended folder.
How the attack works
The stata_do tool builds a Stata command like log using "<log_file_name>", ... by directly inserting whatever value it receives for log_file_name (also called log_name). An attacker supplies a value that closes the quote early, or inserts a newline, then appends a Stata command such as shell, python, erase, winexec, or a ! shell-escape. Because the existing content scanner (GuardValidator) only inspects the do-file body and not this wrapper parameter, the injected command passes through unchecked. A separate variant uses ../ path segments in the same parameter to write files outside the log directory instead of injecting a command.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9cb8e958-a10b-4673-8736-ed95d3400f5e
- Severity
- Critical
- CVEs
- CVE-2026-47708
Why it matters
An attacker can achieve remote code execution on the machine running Stata, or overwrite/create arbitrary files outside the intended log directory, using nothing but a crafted filename parameter.
What you can do
- →Validate and sanitize the log_file_name/log_name parameter separately from do-file content — reject quotes, newlines, and shell/Stata command tokens.
- →Restrict log_file_name to a safe character set (alphanumeric, dash, underscore) and reject any path-traversal segments like ../.
- →Run the stata_do tool with the least privilege necessary, and restrict its filesystem write access to a dedicated log directory.
- →Review or update any content-scanning tool (like GuardValidator) so it also inspects wrapper parameters, not just do-file bodies.
Known benign look-alikes
- A log_file_name value that legitimately contains a single quote as part of a project naming convention but no command token follows.
- Security advisory or PR text quoting the CVE-2026-47708 payload.
- A stata_do call with a plain alphanumeric log_file_name and no quote/newline breakout.