Skip to content
OpenAdvisories

Product · cdeust

Cortex

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-49986

    Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`

    The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Corte…

    cdeust Cortex neuro-cortex-memory PyPI