GHSA-xc9g-j69q-37xw: Path Traversal
Impact An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the consciousness-explorer component of sublinear-time-solver. The MCP exportstate (and importstate) tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync / fs.readFileSync without constraining the destination or rejecting path traversal. An attacker able to invoke the MCP tool could write or overwrite any file accessible to the server process (e.g. ~/.ssh/authorizedkeys, application files), leading to integrity loss and potential service disruption.
The same sink class was present in the main solver MCP server (saveVectorToFile / loadVectorFromFile).
Affected versions - consciousness-explorer < 1.1.2 - sublinear-time-solver < 1.6.0 - sublinear (crates.io) < 0.2.0
Patches - consciousness-explorer@1.1.2 - sublinear-time-solver@1.6.0 - sublinear@0.2.0
State/vector files are now confined to a dedicated directory (overridable via $CONSCIOUSNESSEXPLORERSTATEDIR / $SUBLINEARSOLVERVECTORDIR), a basename-only contract is enforced (rejecting separators, .., NUL/control chars, hidden files, and Windows reserved names), and files are opened with ONOFOLLOW | OCLOEXEC mode 0o600. Covered by 14 regression tests in tests/consciousness/safe-path.test.mjs.
Breaking change: callers must now pass a basename, not an absolute path.
Workarounds Do not expose the MCP server to untrusted clients; restrict exportstate to trusted local users; run the server under a low-privilege account with a restricted working directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/sublinear-time-solverto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
npm/consciousness-explorerto a version that resolves this vulnerability.Fixed in 1.1.2 - Upgrade
Upgrade
consciousness-explorerto a version that resolves this vulnerability.Fixed in 1.1.2 - Upgrade
Upgrade
sublinear-time-solverto a version that resolves this vulnerability.Fixed in 1.6.0 - Upgrade
Upgrade
sublinearto a version that resolves this vulnerability.Fixed in 0.2.0 - Configuration
Update the MCP tools (export_state and import_state, and the sink class using saveVectorToFile/loadVectorFromFile) to enforce a basename-only contract for destination/source paths and reject path traversal and unsafe filenames as described (reject separators, '..', NUL/control chars, hidden files, and Windows reserved names).
MCP server (export_state/import_state) filepath argument handling = basename-only contract (reject separators, .., NUL/control chars, hidden files, Windows reserved names) - Configuration
Configure state/vector files to be confined to a dedicated directory, using $CONSCIOUSNESS_EXPLORER_STATE_DIR and/or $SUBLINEAR_SOLVER_VECTOR_DIR where applicable, instead of writing to arbitrary user-supplied paths.
MCP server State/vector directories = Use dedicated directory (overridable via $CONSCIOUSNESS_EXPLORER_STATE_DIR / $SUBLINEAR_SOLVER_VECTOR_DIR) - Configuration
When opening state/vector files for export/import, use O_NOFOLLOW | O_CLOEXEC and create/open with mode 0o600 to prevent following symlinks and to ensure restrictive permissions.
File open mode for state/vector files open flags/permissions = O_NOFOLLOW | O_CLOEXEC mode 0o600 - Compensating control
Do not expose the MCP server to untrusted clients; restrict access to export_state to trusted local users.
- Compensating control
Run the MCP server under a low-privilege account with a restricted working directory so the server process cannot write arbitrary files outside its allowed area.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
An attacker must be able to invoke the affected MCP tools. The impact is limited to files that the server process can read or write, but this can include SSH authorized keys and application files.
Which components and versions need remediation?
Upgrade consciousness-explorer to 1.1.2 or later, sublinear-time-solver to 1.6.0 or later, and the crates.io sublinear package to 0.2.0 or later. Earlier versions are affected.
What protections do the patched releases add?
Patched releases confine state and vector files to dedicated directories and enforce basename-only filenames. They reject path separators, .., NUL and control characters, hidden files, and other unsafe path input.
Can the storage directory be configured after upgrading?
Yes. The consciousness-explorer state directory can be overridden with CONSCIOUSNESS_EXPLORER_STATE_DIR, and the sublinear-time-solver vector directory can be overridden with SUBLINEAR_SOLVER_VECTOR_DIR.