Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

stata-mcp

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
1.25.3 (Nov 6, 2026): no advisory affects it
Newest unaffected release
1.25.3 (Nov 6, 2026), the latest release
Advisories
3 · 2 critical, 1 high
Weekly downloads
1,440
Dependents
0
Releases
112 since 0.1.0 (Jun 9, 2025)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

    Affected: fixed in 1.19.0.

    Fixed in 1.19.0 (released Jun 9, 2026, 104 days before disclosure).

    The latest release, 1.25.3, is not affected.

  • CVE-2026-47708Critical 9.3

    MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper

    Affected: fixed in 1.17.3.

    Fixed in 1.17.3 (released May 19, 2026, 63 days before disclosure).

    The latest release, 1.25.3, is not affected.

  • CVE-2026-31040Critical 9.8

    A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead…

    Affected: fixed in 1.13.0.

    Fixed in 1.13.0 (released Nov 20, 2025, 139 days before disclosure).

    The latest release, 1.25.3, is not affected.