CVE-2026-55609
Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export_state and import_state tools in src/consciousness-explorer/mcp/server.js pass the attacker-controlled filepath parameter to filesystem operations in…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export_state and import_state tools in src/consciousness-explorer/mcp/server.js pass the attacker-controlled filepath parameter to filesystem operations in src/consciousness-explorer/index.js without restricting the destination or rejecting traversal. The saveVectorToFile and loadVectorFromFile tools in src/mcp/server.ts contain the same sink class through the file_path parameter. An attacker able to invoke the MCP tools can read, write, or overwrite any file accessible to the server process, causing confidentiality and integrity loss and possible service disruption. This issue is fixed in consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- EPSS
- 0.17% probability · 7th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-73
- Source
- security-advisories@github.com
EPSS 0.2% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/BruceJqs/public_exp/issues/32
- https://github.com/ruvnet/sublinear-time-solver/commit/a701296e363192be863e79d788fa268095e3d229
- https://github.com/ruvnet/sublinear-time-solver/commit/ea9a212b69e4449ec443fe088a7aec7546f70b4a
- https://github.com/ruvnet/sublinear-time-solver/issues/19
- https://github.com/ruvnet/sublinear-time-solver/pull/20
- https://github.com/ruvnet/sublinear-time-solver/releases/tag/v1.6.0
- https://github.com/ruvnet/sublinear-time-solver/security/advisories/GHSA-xc9g-j69q-37xw
- https://github.com/BruceJqs/public_exp/issues/32
- https://github.com/ruvnet/sublinear-time-solver/issues/19
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.