CVE-2026-55609: Sublinear-Time-Solver Path Traversal

CVE-2026-55609 Overview

CVE-2026-55609 is a path traversal vulnerability [CWE-73] in the sublinear-time-solver Rust and WebAssembly library and its companion consciousness-explorer package. The flaw exists in Model Context Protocol (MCP) server tools that accept attacker-controlled file path parameters without validation. Affected tools include export_state and import_state in src/consciousness-explorer/mcp/server.js, plus saveVectorToFile and loadVectorFromFile in src/mcp/server.ts. An attacker able to invoke these MCP tools can read, write, or overwrite any file accessible to the server process. The issue is fixed in consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0.

Critical Impact
An authenticated MCP client can traverse the filesystem to overwrite arbitrary files, causing integrity loss and possible service disruption on the host running the MCP server.

Affected Products

sublinear-time-solver versions prior to 1.6.0
consciousness-explorer versions prior to 1.1.2
MCP servers exposing the export_state, import_state, saveVectorToFile, and loadVectorFromFile tools

Discovery Timeline

2026-08-25 - CVE-2026-55609 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-55609

Vulnerability Analysis

The vulnerability arises from four MCP tool handlers that forward caller-supplied path parameters directly to Node.js filesystem APIs. In src/consciousness-explorer/mcp/server.js, the export_state and import_state tools accept a filepath string and pass it to exportState() and importState() in src/consciousness-explorer/index.js. Those functions previously invoked fs.writeFileSync and fs.readFileSync without normalizing or containing the path. The saveVectorToFile and loadVectorFromFile tools in src/mcp/server.ts share the same sink pattern through their file_path parameter. Because the MCP tool schemas placed no restriction on separators, .. segments, or absolute paths, the process could be coerced into touching any file its user account could reach.

Root Cause

The root cause is missing path containment as classified in CWE-73: External Control of File Name or Path. The MCP tool schemas declared filepath as a free-form string, and the downstream handlers called path.resolve(filePath) before passing the result to filesystem primitives. Resolving an attacker-controlled path preserves absolute prefixes and traversal sequences, so no directory boundary was enforced.

Attack Vector

Exploitation requires the ability to invoke MCP tools exposed by a vulnerable server instance. A caller supplies a filepath such as ../../etc/hosts or /etc/passwd to export_state, import_state, saveVectorToFile, or loadVectorFromFile. Writes overwrite the target file with serialized state or vector data. Reads return the target file's contents to the MCP client. The attack is local to the MCP transport and requires low privileges, but yields high impact to integrity and availability of any file the server process can access.

javascript

// Security patch in src/consciousness-explorer/index.js
// SECURITY (issue #19, CWE-73): `filepath` arrives from an MCP caller
// and used to land straight in fs.writeFileSync — allowing arbitrary
// file writes. Force it through resolveStatePath so it can only
// resolve to a basename inside the dedicated state directory.
async exportState(filepath) {
    const { safeWriteState } = await import('./lib/safe-path.js');

    const state = {
        version: VERSION,
        timestamp: Date.now(),
        // ...
    };
}

Source: GitHub Commit ea9a212

Detection Methods for CVE-2026-55609

Indicators of Compromise

MCP tool invocations where filepath or file_path parameters contain path separators (/, \), .. segments, or absolute path prefixes.
Unexpected writes by the MCP server process to files outside ~/.consciousness-explorer/state or ~/.sublinear-time-solver/vectors.
New or modified files owned by the MCP server user in sensitive directories such as /etc, ~/.ssh, or application configuration paths.

Detection Strategies

Log every MCP tool call and inspect the filepath and file_path arguments for characters matching the pattern [/\\] or containing ...
Compare MCP process filesystem activity against an allowlist of the dedicated state and vector directories.
Alert on invocations of export_state, import_state, saveVectorToFile, or loadVectorFromFile from unexpected client identities.

Monitoring Recommendations

Enable audit logging (auditd on Linux) for the MCP server user with rules covering writes to /etc, home directories, and cron paths.
Monitor file integrity on any host running sublinear-time-solver or consciousness-explorer MCP servers.
Correlate MCP application logs with endpoint telemetry to link tool calls to resulting filesystem operations.

How to Mitigate CVE-2026-55609

Immediate Actions Required

Upgrade consciousness-explorer to version 1.1.2 or later and sublinear-time-solver to version 1.6.0 or later.
Restrict network and transport access to the MCP server so only trusted clients can invoke tools.
Run the MCP server process under a dedicated low-privilege account with no access to sensitive files.

Patch Information

The fix is delivered in sublinear-time-solver release v1.6.0 and coordinated through GitHub Security Advisory GHSA-xc9g-j69q-37xw. The patches introduce a safe-path module that confines writes and reads to dedicated state and vector directories configurable via CONSCIOUSNESS_EXPLORER_STATE_DIR and SUBLINEAR_SOLVER_VECTOR_DIR. Tool input schemas now enforce a basename-only pattern that rejects separators, null bytes, and Windows reserved names. See GitHub Commit a701296 and GitHub Commit ea9a212 for the code changes.

Workarounds

If patching is not immediately possible, disable the export_state, import_state, saveVectorToFile, and loadVectorFromFile tools in the MCP server configuration.
Front the MCP server with an authorization proxy that rejects any filepath or file_path value containing /, \, .., or a drive letter.
Confine the MCP process with a mandatory access control profile (AppArmor, SELinux) that limits writes to the dedicated state and vector directories.

bash

# Configuration example: constrain MCP state and vector directories
export CONSCIOUSNESS_EXPLORER_STATE_DIR="/var/lib/consciousness-explorer/state"
export SUBLINEAR_SOLVER_VECTOR_DIR="/var/lib/sublinear-time-solver/vectors"

install -d -m 0700 -o mcp -g mcp "$CONSCIOUSNESS_EXPLORER_STATE_DIR"
install -d -m 0700 -o mcp -g mcp "$SUBLINEAR_SOLVER_VECTOR_DIR"

npm install consciousness-explorer@1.1.2 sublinear-time-solver@1.6.0