MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708) - ATR-2026-01983 (ff6a8562-b6f9-5527-901c-4991492b6d65)
Detects CVE-2026-47708 (CVSS critical, CWE-77): the log_file_name (aka log_name) parameter accepted by the stata_do MCP tool / CLI is interpolated directly into a Stata log using "<log_file>", ... command string without sanitization. GuardValidator only scans do-file content, not this wrapper parameter. An attacker breaks out of the quoted log-path string with a quote or newline and appends a dangerous Stata command (shell, python, erase, winexec, or ! shell-escape), achieving remote code execution, or supplies ../ path-traversal segments in log_name to write arbitrary files outside the log directory.
Detection covers: (a) a stata_do tool call whose log_file_name/log_name value contains a
quote/newline breakout followed by a dangerous Stata command token;
(b) a log_file_name/log_name value containing path-traversal segments; (c) explicit CVE-2026-47708 exploitation framing referencing the
log_file_name / stata_do injection.
The detection target is the request shape — a stata_do log_file_name parameter carrying a string-breakout plus command injection or path traversal — the exact CVE-2026-47708 primitive, caught before the wrapper builds the Stata command string.