CVE-2026-31040 is a critical remote code execution vulnerability in stata-mcp versions prior to 1.13.0, stemming from insufficient validation of user-supplied Stata do-file content. The flaw allows attackers to achieve arbitrary command execution on affected systems without requiring authentication or user interaction. The vulnerability carries a CVSS v3.1 score of 9.8 (Critical) with a network-based attack vector, low complexity requirements, and no privileges or user interaction needed, resulting in complete compromise of confidentiality, integrity, and availability. This represents one of the most severe vulnerability profiles possible. Currently, there is no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat tracking lists. The low EPSS probability score of 0.00124 suggests limited current exploitation activity, though organizations should prioritize patching to version 1.13.0 or later to mitigate this critical risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.13.0CPE matchmatch criteria | cpe:2.3:a:statamcp:stata-mcp:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.