Attack Chain

1. An attacker crafts a malicious project directory, including specific marker files (mcp_server/ subdirectory, ui/unified-viz.html) and an arbitrary Python script positioned at mcp_server/server/visualize_bootstrap.py.
2. The attacker social-engineers the victim into opening this malicious project within the Claude Code IDE.
3. Upon opening the project, the Claude Code IDE extension automatically sets the CLAUDE_PROJECT_DIR environment variable to the path of the malicious project.
4. The victim subsequently invokes the /cortex-visualize slash command or triggers the open_visualization MCP tool within the Claude Code interface.
5. The open_visualization handler in mcp_server/handlers/open_visualization.py resolves the path specified by CLAUDE_PROJECT_DIR as a trusted Cortex source root, due to the presence of the attacker-controlled marker files.
6. The handler then constructs a path to the attacker's visualize_bootstrap.py script located within the malicious project directory.
7. The handler executes this malicious visualize_bootstrap.py script via subprocess.run([sys.executable, ...]) with the full privileges of the victim's local user account.
8. The executed malicious script performs actions such as data exfiltration (e.g., files, secrets, SSH/GPG keys), local file modification, or establishes persistence by overwriting files in the Cortex plugin cache directory via a secondary path in http_launcher.py.

Impact

This vulnerability leads to local arbitrary code execution (LACE) with the privileges of the victim's local user account. Any user with Cortex MCP plugin installed who is tricked into opening an attacker-controlled project in Claude Code and activating the visualization tool is at severe risk. The consequences include, but are not limited to, complete compromise of user data confidentiality through exfiltration of files, secrets, and credentials (e.g., environment variables, SSH/GPG keys). Integrity is also threatened, as attackers can modify or delete local files, source code, and cached data. Furthermore, the attack can impact system availability by terminating local processes or destroying user data. The secondary execution path via http_launcher.py enables persistence by allowing attackers to overwrite files in the Cortex plugin cache.

Recommendation

• Immediately apply the vendor-recommended remediation to patch mcp_server/handlers/open_visualization.py and mcp_server/server/http_launcher.py to remove CLAUDE_PROJECT_DIR from the dev-source candidate list and gate executable dev-source resolution behind an explicit opt-in flag, as described in CVE-2026-49986.
• Ensure that all instances of neuro-cortex-memory are updated to a version greater than 3.17.0.
• Educate users about the risks of opening untrusted project directories or repositories in development environments and the potential for social engineering to exploit CVE-2026-49986.