CVE-2026-55609: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write

export_state passed the user-supplied filepath to fs.writeFileSync, and import_state to fs.readFileSync, with no check on the destination and no rejection of path traversal. The main solver's saveVectorToFile and loadVectorFromFile had the same flaw. So whoever can invoke the MCP tool decides where the server writes, and in the case of an export, partly what it writes.

The advisory's example targets are ~/.ssh/authorized_keys and application files. Overwriting the first can give an attacker SSH access, and overwriting application files can break or alter the service. The advisory scores this as local with low privileges (CVSS 7.1), with high integrity and availability impact and no confidentiality impact. Reading through import_state is described as the same sink class, not as a way to exfiltrate data.

In practice the caller is an MCP client: a local user, another process connected to the server, or an agent steered by a prompt injection. Servers exposed to untrusted clients are the most at risk. The process's own privileges set the limit, so a server run as root loses the most.

• consciousness-explorer below 1.1.2 (npm)
• sublinear-time-solver below 1.6.0 (npm)
• sublinear below 0.2.0 (crates.io)

The npm packages are the ones in the package data. Check what you have installed:

npm ls consciousness-explorer sublinear-time-solver
cargo tree -i sublinear

You are exposed if the MCP server is running and any client you do not fully trust can call export_state or saveVectorToFile.

Upgrade to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0:

npm install [email protected] [email protected]

The advisory also names [email protected] on crates.io. The release adds a safe-path module. State files live in ~/.consciousness-explorer/state (override with CONSCIOUSNESS_EXPLORER_STATE_DIR) and vectors in ~/.sublinear-time-solver/vectors (override with SUBLINEAR_SOLVER_VECTOR_DIR). Only bare file names are accepted. Separators, .., hidden files, NUL and control characters and Windows reserved names are rejected, and files open with O_NOFOLLOW and mode 0o600.

Breaking change: callers that pass an absolute path such as /tmp/snapshot.json must pass snapshot.json or point the environment variable at /tmp.

Workarounds from the advisory: do not expose the MCP server to untrusted clients, restrict export_state to trusted local users, and run the server as a low-privilege account with a restricted working directory.

Check MCP logs for export_state, import_state, saveVectorToFile and loadVectorFromFile calls whose filepath is absolute or contains ... Then look at what those paths point to: ~/.ssh/authorized_keys, shell startup files and the application's own files, for changes you did not make.

File modification times on those targets, compared against the server's start time, narrow down the window. Beam records agent file access and MCP tool calls, so an agent-driven write to a sensitive path shows up there.

Impact

An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the consciousness-explorer component of sublinear-time-solver. The MCP export_state (and import_state) tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync / fs.readFileSync without constraining the destination or rejecting path traversal. An attacker able to invoke the MCP tool could write or overwrite any file accessible to the server process (e.g. ~/.ssh/authorized_keys, application files), leading to integrity loss and potential service disruption.

The same sink class was present in the main solver MCP server (saveVectorToFile / loadVectorFromFile).

Affected versions

• consciousness-explorer < 1.1.2
• sublinear-time-solver < 1.6.0
• sublinear (crates.io) < 0.2.0

Patches

• [email protected]
• [email protected]
• [email protected]

State/vector files are now confined to a dedicated directory (overridable via $CONSCIOUSNESS_EXPLORER_STATE_DIR / $SUBLINEAR_SOLVER_VECTOR_DIR), a basename-only contract is enforced (rejecting separators, .., NUL/control chars, hidden files, and Windows reserved names), and files are opened with O_NOFOLLOW | O_CLOEXEC mode 0o600. Covered by 14 regression tests in tests/consciousness/safe-path.test.mjs.

Breaking change: callers must now pass a basename, not an absolute path.

Workarounds

Do not expose the MCP server to untrusted clients; restrict export_state to trusted local users; run the server under a low-privilege account with a restricted working directory.