CVE-2026-49986

Name of the Vulnerable Software and Affected Versions neuro-cortex-memory versions 3.17.0 and later

Description Local arbitrary code execution is possible because the server treats the CLAUDE PROJECT DIR environment variable as a trusted source root. When the open visualization tool is invoked, the find dev source() function identifies the active project directory as a candidate root. The is cortex root() function only validates the presence of an mcp server/ subdirectory and a ui/unified-viz.html file. An attacker can place these marker files in a malicious repository to force the execution of an arbitrary mcp server/server/visualize bootstrap.py file via subprocess.run(). Additionally, a secondary execution path exists in mcp server/server/http launcher.py that allows the use of rsync to overwrite files in the plugin cache directory. The entry point is the open visualization MCP tool.

Recommendations For versions 3.17.0 and later, remove CLAUDE PROJECT DIR from the dev-source candidate list in mcp server/handlers/open visualization.py and mcp server/server/http launcher.py. Require an explicit opt-in by ensuring the bootstrap path is only triggered if both CORTEX DEV SOURCE SYNC is set to 1 and CORTEX DEV ROOT is defined. As a temporary mitigation, avoid invoking the open visualization tool when working with untrusted project directories.