CVE-2026-49986: Cortex MCP server code execution via malicious project directory

Summary

The Cortex MCP server (`neuro-cortex-memory`) before version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable, which Claude Code sets to the open project directory, as a trusted Cortex developer checkout. When `open_visualization` runs, `_find_dev_source()` accepts that directory as a source root if `_is_cortex_root()` finds an `mcp_server/` subdirectory and a `ui/unified-viz.html` file. An attacker who places those two marker files in a malicious repository can make Cortex run `mcp_server/server/visualize_bootstrap.py` from it via `subprocess.run`, executing code with the victim's local user privileges.

Mitigation

Fixed in 3.17.1.

Topics

• Model Context Protocol

Related items

• MediumARTEX and beyond: AI-enabled penetration testing platformsSimilar attack · Cisco Talos Blog
• MediumAmazon Threat Intelligence observes threat actors running cybercrime campaigns with ARTEX AI agentsSimilar attack · AWS Security Blog
• InfoHow AI is changing the nature of cyberattacksSimilar attack · CSO Online
• MediumInside the loop: Five AI attack frameworks that never ask permissionSimilar attack · Elastic Security Labs
• MediumARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.Similar attack · StepSecurity Blog