CVE-2026-49986: 
Python vulnerability analysis and mitigation

CVE-2026-49986 is an untrusted project bootstrap code execution vulnerability in the Cortex MCP server (neuro-cortex-memory) that allows local attackers to execute arbitrary Python code by placing crafted marker files in a malicious project directory. The vulnerability affects neuro-cortex-memory versions ≤ 3.17.0 and was first published by the maintainer on May 27, 2026, with the GitHub Advisory Database entry added on July 1, 2026. It carries a CVSS v3.1 base score of 7.8 (High) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Cortex Advisory).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The _find_dev_source() function in mcp_server/handlers/open_visualization.py iterates over both CORTEX_DEV_ROOT and CLAUDE_PROJECT_DIR environment variables to build a list of candidate Cortex source directories. Since CLAUDE_PROJECT_DIR is automatically set by the Claude Code IDE extension to the currently open project directory, any project a user opens is silently treated as a trusted Cortex developer checkout. The only validation performed by _is_cortex_root() is checking for the presence of an mcp_server/ subdirectory and a ui/unified-viz.html file — trivially replicable markers — after which mcp_server/server/visualize_bootstrap.py is executed unconditionally via subprocess.run([sys.executable, ...]). A secondary execution path exists in mcp_server/server/http_launcher.py, where the same derived source is used to rsync attacker-controlled files into the Cortex plugin cache directory. A public proof-of-concept is included in the advisory (GitHub Advisory, Cortex Advisory).

Successful exploitation results in arbitrary Python code execution with the full privileges of the victim's local user account — the same account running Claude Code and the Cortex MCP server process. Confidentiality impact includes exfiltration of local files, secrets, environment variables, and SSH/GPG keys; integrity impact includes modification or deletion of source code, credentials, and plugin caches; availability impact includes termination of local processes or destruction of user data. The secondary http_launcher.py path additionally allows an attacker to overwrite files in the Cortex plugin cache directory, potentially establishing persistence that survives after the malicious project is closed (Cortex Advisory).

A public proof-of-concept is included in the official advisory, demonstrating the full attack chain with an inline Python script. The CVSS v4.0 exploit maturity is rated "POC" (proof-of-concept available). No in-the-wild exploitation has been reported, and no threat actor attribution is available. The CVE status remains "Reserved" in the NVD. The vulnerability is detected by Qualys (detection ID 5014965) (GitHub Advisory, Cortex Advisory).

1. Prepare malicious repository: Create a directory structure mimicking a Cortex source root by adding an mcp_server/server/ subdirectory and a ui/unified-viz.html file — the only two markers checked by _is_cortex_root().
2. Plant malicious bootstrap script: Place an arbitrary Python payload at mcp_server/server/visualize_bootstrap.py within the crafted directory (e.g., a script that exfiltrates SSH keys or establishes a reverse shell).
3. Social-engineer the victim: Distribute the malicious repository (e.g., via GitHub, a phishing link, or a supply-chain attack) and convince the victim to open it in Claude Code, which automatically sets CLAUDE_PROJECT_DIR to that directory.
4. Trigger the vulnerable tool: Wait for or prompt the victim to invoke the open_visualization MCP tool (e.g., via the /cortex-visualize slash command in the Claude Code interface).
5. Code execution achieved: _find_dev_source() picks up CLAUDE_PROJECT_DIR, _is_cortex_root() validates the crafted markers, and subprocess.run([sys.executable, str(bootstrap_path)]) executes the attacker's Python script with the victim's local user privileges (Cortex Advisory).

• File System: Presence of mcp_server/server/visualize_bootstrap.py in an unexpected or non-Cortex project directory; unexpected files written to the Cortex plugin cache directory (populated via rsync from an attacker-controlled source); sentinel files such as /tmp/cortex-open-visualization-poc-owned created by PoC payloads.
• Process: Unexpected Python child processes (sys.executable) spawned by the Cortex MCP server process executing scripts from user project directories rather than the installed Cortex package path; rsync processes initiated by http_launcher.py copying files from an untrusted source.
• Logs: MCP server logs showing invocation of open_visualization tool with a CLAUDE_PROJECT_DIR pointing to an unfamiliar or recently cloned repository; subprocess execution records referencing visualize_bootstrap.py outside the installed Cortex package directory (Cortex Advisory).

Upgrade neuro-cortex-memory to version 3.17.1 or later, which removes CLAUDE_PROJECT_DIR from the dev-source candidate list and gates executable dev-source resolution behind an explicit opt-in flag (CORTEX_DEV_SOURCE_SYNC=1 combined with CORTEX_DEV_ROOT) (Cortex Release). The same fix must be applied to mcp_server/server/http_launcher.py to eliminate the secondary rsync-based execution path. As a temporary workaround for users unable to upgrade immediately, avoid opening untrusted project directories in Claude Code while the Cortex MCP server is active, and ensure CORTEX_DEV_ROOT is not set to any attacker-controlled path (Cortex Advisory).

The vulnerability was reported by researcher useworld and analyzed by EQSTLab, as credited in the official advisory. No broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (Cortex Advisory).