GHSA-49m4-vp58-wgc9: MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

The `ado_package_install` tool in stata-mcp has a command injection vulnerability where user input in the `package` parameter is directly inserted into a Stata command without validation, allowing attackers to inject newline characters and arbitrary Stata commands, including the `shell` command (which runs OS-level code). This leads to RCE (remote code execution, where an attacker can run commands on a system they don't own) with a CVSS score (a 0-10 rating of how severe a vulnerability is) of 8.4 (High), and the tool is enabled by default.