CVE-2026-55609: sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_state
Impact An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the consciousness-explorer component of sublinear-time-solver. The MCP exportstate (and importstate) tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync / fs.readFileSync without constraining the destination or rejecting path traversal. An attacker able to invoke the MCP tool could write or overwrite any file accessible to the server process (e.g. ~/.ssh/authorizedkeys, application files), leading to integrity loss and potential service disruption.
The same sink class was present in the main solver MCP server (saveVectorToFile / loadVectorFromFile).
Affected versions - consciousness-explorer < 1.1.2 - sublinear-time-solver < 1.6.0 - sublinear (crates.io) < 0.2.0
Patches - consciousness-explorer@1.1.2 - sublinear-time-solver@1.6.0 - sublinear@0.2.0
State/vector files are now confined to a dedicated directory (overridable via $CONSCIOUSNESSEXPLORERSTATEDIR / $SUBLINEARSOLVERVECTORDIR), a basename-only contract is enforced (rejecting separators, .., NUL/control chars, hidden files, and Windows reserved names), and files are opened with ONOFOLLOW | OCLOEXEC mode 0o600. Covered by 14 regression tests in tests/consciousness/safe-path.test.mjs.
Breaking change: callers must now pass a basename, not an absolute path.
Workarounds Do not expose the MCP server to untrusted clients; restrict exportstate to trusted local users; run the server under a low-privilege account with a restricted working directory.
Other sources
sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the attacker-controlled filepath parameter to filesystem operations in src/consciousness-explorer/index.js without restricting the destination or rejecting traversal. The saveVectorToFile and loadVectorFromFile tools in src/mcp/server.ts contain the same sink class through the filepath parameter. An attacker able to invoke the MCP tools can read, write, or overwrite any file accessible to the server process, causing confidentiality and integrity loss and possible service disruption. This issue is fixed in consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/sublinear-time-solverto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
npm/consciousness-explorerto a version that resolves this vulnerability.Fixed in 1.1.2 - Upgrade
Upgrade
consciousness-explorerto a version that resolves this vulnerability.Fixed in 1.1.2 - Upgrade
Upgrade
sublinear-time-solverto a version that resolves this vulnerability.Fixed in 1.6.0 - Compensating control
Do not expose the MCP server to untrusted clients; restrict `export_state` to trusted local users.
- Compensating control
Run the MCP server under a low-privilege account with a restricted working directory.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to invoke the affected MCP tools and provide the filepath argument. Exploitation is local in the supplied severity vector and requires low privileges, but no user interaction.
Which components and versions need remediation?
Update consciousness-explorer to 1.1.2 or later, sublinear-time-solver to 1.6.0 or later, and the crates.io sublinear package to 0.2.0 or later. Earlier versions are affected as listed.
What is the impact if exploitation succeeds?
The attacker can write or overwrite files accessible to the server process, including application files or SSH authorized_keys. This can cause integrity loss and service disruption.
What changes in the patched releases reduce the risk?
Patched releases confine state and vector files to dedicated directories and enforce basename-only filenames. They reject path separators, .., NUL or control characters, hidden files, and other disallowed filename patterns.
Can the storage directory be configured after upgrading?
Yes. The consciousness-explorer state directory can be overridden with CONSCIOUSNESS_EXPLORER_STATE_DIR, and the solver vector directory can be overridden with SUBLINEAR_SOLVER_VECTOR_DIR.