CVE-2026-55609: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write
An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the consciousness-explorer component of sublinear-time-solver. The MCP export_state (and import_state) tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync / fs.readFileSync without constraining the destination or rejecting path traversal. An attacker able to invoke the MCP tool could write or overwrite any file accessible to the server process (e.g. ~/.ssh/authorized_keys, application files), leading to integrity loss and potential service disruption.
The same sink class was present in the main solver MCP server (saveVectorToFile / loadVectorFromFile).
References
- github.com/BruceJqs/public_exp/issues/32
- github.com/advisories/GHSA-xc9g-j69q-37xw
- github.com/ruvnet/sublinear-time-solver/commit/a701296e363192be863e79d788fa268095e3d229
- github.com/ruvnet/sublinear-time-solver/commit/ea9a212b69e4449ec443fe088a7aec7546f70b4a
- github.com/ruvnet/sublinear-time-solver/issues/19
- github.com/ruvnet/sublinear-time-solver/pull/20
- github.com/ruvnet/sublinear-time-solver/releases/tag/v1.6.0
- github.com/ruvnet/sublinear-time-solver/security/advisories/GHSA-xc9g-j69q-37xw
- nvd.nist.gov/vuln/detail/CVE-2026-55609
Code Behaviors & Features
Detect and mitigate CVE-2026-55609 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →