The 'ado_package_install' tool in the 'stata-mcp' package concatenates the user-controlled 'package' argument directly into a Stata command string without validation or sanitization. This string is sent verbatim to the Stata interpreter, which executes each line separately. Because Stata supports a 'shell' command that executes OS shell commands, an attacker can inject newline characters and shell commands to achieve arbitrary OS command execution. The vulnerability arises from the lack of input validation on the 'package' parameter and the absence of guard checks on this execution path. The tool is registered in the default 'all' profile, making it enabled by default. Proof-of-concept exploits demonstrate the creation of arbitrary files on the host system via injected shell commands.

Successful exploitation allows an attacker with access to invoke the 'ado_package_install' MCP tool or its Python API to execute arbitrary OS-level commands with the privileges of the Stata-MCP server process. This can lead to full remote code execution, compromising the host system. The vulnerability is rated high severity with a CVSS score of 8.4, reflecting its potential for complete system compromise without requiring user interaction or privileges.

A patch is available for this vulnerability. Users should upgrade to version 1.19.0 or later of 'stata-mcp' to remediate the issue. Until patched, avoid exposing the MCP server to untrusted users or networks. Note that the existing command guard mechanism does not protect the 'ado_package_install' path, so relying on it is insufficient. Follow vendor guidance for applying the official fix.