CVE-2026-31040

Katalog CVE

CVSS 9.8 · Critical EPSS 1,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada statamcp stata-mcp. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

A vulnerability was identified in stata-mcp prior to v1.13.0 where insufficient validation of user-supplied Stata do-file content can lead to command execution.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

25 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/SepineTam/stata-mcp/issues/20 issue tracking · advisory vendor
• https://github.com/SepineTam/stata-mcp/commit/52413ce patch
• https://github.com/SepineTam/stata-mcp/pull/21 issue tracking
• https://github.com/SepineTam/stata-mcp/releases/tag/v1.13.0 release notes