The Cortex MCP server mistakenly trusts the CLAUDE_PROJECT_DIR environment variable, which points to the currently open project directory. When the open_visualization tool is run, it searches for a Cortex source root by checking only for an mcp_server/ subdirectory and a ui/unified-viz.html file. An attacker can place these two marker files in a malicious repository so that the tool treats it as a valid source root; the bootstrap script visualize_bootstrap.py is then executed via subprocess. This results in code execution with the privileges of the local user process, allowing an attacker to run arbitrary code on the host system.

Cortex (neuro‑cortex‑memory) from vendor cdeust. Versions prior to 3.17.1 are affected; the issue is fixed in Cortex 3.17.1 and later.

The CVSS score is 7.1, indicating a medium severity vulnerability. EPSS data is not available, so the exact probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a repository containing the marker files and to invoke the open_visualization tool as an authenticated local user. Once the tool resolves the untrusted directory, the malicious bootstrap script runs automatically, enabling local code execution. The risk is moderate due to the need for an authenticated user to trigger the tool, but the impact is significant for compromised hosts.