The Cortex MCP server ("neuro-cortex-memory"), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the "CLAUDE_PROJECT_DIR" environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the "open_visualization" tool is invoked, "_find_dev_source()" resolves the user's active project directory as a candidate Cortex source root. The only validation performed by "_is_cortex_root()" is a check for the presence of an "mcp_server/" subdirectory and a "ui/unified-viz.html" file. An attacker who places these two marker files in a malicious repository can cause Cortex to execute an arbitrary "mcp_server/server/visualize_bootstrap.py" from that directory via "subprocess.run([sys.executable, ...])", achieving code execution with the privileges of the victim's local user process. Version 3.17.1 fixes the issue.