CVE-2025-6998: Untrusted Bootstrap Code Execution (RCE) in Cortex MCP Server with POC

Vulnerability Overview Vulnerability Name: Untrusted Project Bootstrap Code Execution via Vulnerability Description: This vulnerability exists in the Cortex MCP server ( ). When the tool is used, it checks the environment variable , which is automatically set by the Claude IDE extension. If the user's currently open project directory contains an subdirectory and a file, Cortex will execute the script in that directory, running arbitrary code with the permissions of the local user. The exploit requires no authentication; an attacker only needs to place two marker files in a malicious repository to trigger it. Impact Scope Affected Versions: = 3.17.1 CVSS Score: 7.8 (High) CVE Number: CVE-2025-6998 Weakness: CWE-829 Remediation Recommended Fix: - Remove from the candidate list. - Introduce an explicit argument in the tool, such that the bootstrap path is only triggered if the user simultaneously sets and . - Apply the same fix to . POC Code Expected Output Impact Confidentiality: Exposure of files, secrets, environment variables, and SSH/GPG keys. Integrity: Modification or deletion of local files, source code, credentials, and plugin caches. Availability: Termination of local processes or corruption of user data. Additional Information Entry Point: MCP tool , registered via standardstdio MCP transport, requiring no authentication. Secondary Code Execution Path: Exists in , allowing attackers to overwrite files in the Cortex plugin cache directory, potentially establishing persistence.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-6998: Untrusted Bootstrap Code Execution (RCE) in Cortex MCP Server with POC

More from this source