The Cortex MCP server (neuro-cortex-memory) before version 3.17.1 improperly trusts the CLAUDE_PROJECT_DIR environment variable set by Claude Code to the current project directory. When the open_visualization tool is used, the function _find_dev_source() treats this directory as a potential Cortex source root if it contains an mcp_server/ subdirectory and a ui/unified-viz.html file. This minimal validation allows an attacker to place these marker files in a malicious repository, causing Cortex to execute the arbitrary script mcp_server/server/visualize_bootstrap.py via subprocess.run with the victim user's privileges, resulting in code execution. The vulnerability is identified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and has a CVSS 4.0 score of 7.1. The issue is resolved in Cortex version 3.17.1.

An attacker who can influence the CLAUDE_PROJECT_DIR environment variable or the contents of the referenced directory can execute arbitrary code with the privileges of the local user running Cortex. This can lead to unauthorized code execution on the victim system. There is no indication of required user interaction or network exploitation, and the attack surface is local. No known exploits in the wild have been reported.

Upgrade Cortex to version 3.17.1 or later, where this vulnerability is fixed. Until then, avoid running Cortex with untrusted CLAUDE_PROJECT_DIR environment variables or directories containing untrusted files that match the marker criteria. Patch status is not explicitly stated beyond the fix in 3.17.1, so check the vendor advisory for the latest remediation guidance.