MCP-for-Stata Parameter Injection via log_file_name Leading to Arbitrary Command Execution

Technical Analysis

The stata_do tool exposed via MCP accepts a log_file_name parameter that is directly concatenated into a Stata command string executed by the server. The existing GuardValidator only inspects do-file content for dangerous patterns but does not apply the same validation to log_file_name, creating an unguarded injection point. By embedding quotes, newlines, or Stata command separators in this parameter, an attacker can break out of the intended argument context and inject arbitrary Stata commands, including shell and python, which allow full OS-level command execution. This crosses the boundary from an ostensibly benign tool-call parameter into full code execution on the underlying host, and any agent or upstream caller with the ability to influence this parameter (including via chained/multi-agent workflows) can leverage it as a privilege escalation and lateral movement vector.

Affected Systems

MCP-for-Stata; protocols: MCP

Detection Signatures

• log_file_name parameter containing quote characters, newlines, or Stata command separators (e.g., `;`, backtick-quote sequences)
• Stata do-file execution logs showing unexpected `shell`, `python`, or `erase` command invocations immediately following a stata_do call
• MCP tool-call arguments where log_file_name deviates from expected filename patterns (e.g., contains path traversal, control characters, or command keywords)
• Unexpected file deletions or shell subprocess spawns correlated with MCP server activity

Remediation Steps

1. 1

   Upgrade to patched version

   Update MCP-for-Stata to version 1.17.3 or later, which fixes the log_file_name sanitization issue.

2. 2

   Sanitize all tool parameters, not just primary content

   Extend GuardValidator or equivalent input validation to cover every parameter interpolated into command strings, including filenames, not just the primary do-file content.

3. 3

   Use parameterized command construction

   Avoid direct string interpolation into Stata command strings; use safe APIs or strict allow-listing of characters for filename-like parameters.

4. 4

   Restrict MCP server privileges

   Run the MCP-for-Stata server with least-privilege OS permissions and sandboxing to limit the blast radius of any injected shell/python commands.

5. 5

   Monitor and log tool invocations

   Log all stata_do calls with full parameter values and alert on anomalous log_file_name values or unexpected command execution.