Cortex MCP Server Directory Trust Leads to Arbitrary Code Execution via CLAUDE_PROJECT_DIR Spoofing
First seen Aug 14, 2026 · Updated Aug 14, 2026
The Cortex MCP server incorrectly trusts the CLAUDE_PROJECT_DIR environment variable to identify a legitimate Cortex source checkout, using only two file-presence checks as validation. An attacker who convinces a victim to open a malicious repository as their active project in Claude Code can plant these marker files and cause Cortex's open_visualization tool to execute an arbitrary attacker-controlled Python script with the victim's local user privileges.
Technical Analysis
The vulnerability lies in `_find_dev_source()` and `_is_cortex_root()`, which resolve the current project directory (set automatically by Claude Code via CLAUDE_PROJECT_DIR) as a candidate trusted Cortex source root. Validation is limited to checking for the existence of an `mcp_server/` subdirectory and a `ui/unified-viz.html` file, both of which are trivial for an attacker to fabricate in any repository. When the `open_visualization` tool is invoked, Cortex runs `subprocess.run([sys.executable, ...])` against `mcp_server/server/visualize_bootstrap.py` located in this unverified directory, effectively executing arbitrary attacker-supplied Python code. The entry point crosses the boundary between the AI coding assistant's project context and the MCP tool's filesystem trust assumptions, turning a benign-looking project directory into a code execution primitive with no user prompt or explicit consent step. The attacker gains full code execution as the victim's local user, enabling further lateral movement, credential theft, or persistent compromise.
Affected Systems
neuro-cortex-memory (Cortex MCP server), Claude Code; protocols: MCP
Detection Signatures
- Presence of unexpected mcp_server/ directory and ui/unified-viz.html marker files in untrusted/third-party repositories
- Process creation logs showing python/subprocess invocation of visualize_bootstrap.py from non-standard or newly cloned repository paths
- CLAUDE_PROJECT_DIR pointing to a directory outside known/trusted Cortex installation paths at time of open_visualization tool invocation
- Unexpected outbound network or file-write activity immediately following an open_visualization tool call in Claude Code session logs
Remediation Steps
- 1
Upgrade Cortex MCP server
Update neuro-cortex-memory to version 3.17.1 or later, which fixes the trust validation logic for candidate Cortex source directories.
- 2
Strengthen directory trust validation
Ensure the MCP server cryptographically verifies or pins the legitimate Cortex installation path rather than relying on marker file presence heuristics tied to an attacker-influenced environment variable.
- 3
Avoid opening untrusted repositories in Claude Code
Do not open third-party or unaudited repositories as active projects in Claude Code sessions with the Cortex MCP server enabled until patched.
- 4
Sandbox MCP tool execution
Run MCP servers and their subprocess-spawning tools in a restricted, least-privilege sandbox to limit the blast radius of arbitrary code execution.
- 5
Audit environment variable trust assumptions
Review other MCP servers and tools for similar patterns where externally-influenced environment variables are treated as trusted paths without independent verification.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.