Command injection via log_file_name parameter in stata-mcp (CVE-2026-47708)

The `log_file_name` parameter in the `stata_do` API and CLI of stata-mcp is interpolated directly into a Stata command string without sanitization, allowing an attacker to break out of the string context and inject arbitrary Stata commands such as `shell`, `python`, or `erase`. The security guard (`GuardValidator`) only validates do-file content and does not inspect this parameter, resulting in a complete bypass. Successful exploitation enables remote code execution and arbitrary file write via path traversal in the log name. Affected versions: - < 1.17.3 We recommend updating to: 1.17.3. CVSS 9.3 · our assessment: act_now Reference: https://github.com/SepineTam/stata-mcp/security/advisories/GHSA-4p62-hqp5-g644 Details: https://vuln.today/cve/CVE-2026-47708