EUVD-2026-65706
GHSA-xc9g-j69q-37xw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Local vector (AV:L) and low privilege (PR:L) reflect MCP tool invocation access requirement; write-only exploit yields no confidentiality impact (C:N).
Primary rating from Vendor (https://github.com/ruvnet/sublinear-time-solver).
CVSS VectorVendor: https://github.com/ruvnet/sublinear-time-solver
Lifecycle Timeline
3DescriptionCVE.org
Impact
An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the consciousness-explorer component of sublinear-time-solver. The MCP export_state (and import_state) tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync / fs.readFileSync without constraining the destination or rejecting path traversal. An attacker able to invoke the MCP tool could write or overwrite any file accessible to the server process (e.g. ~/.ssh/authorized_keys, application files), leading to integrity loss and potential service disruption.
The same sink class was present in the main solver MCP server (saveVectorToFile / loadVectorFromFile).
Affected versions
consciousness-explorer< 1.1.2sublinear-time-solver< 1.6.0sublinear(crates.io) < 0.2.0
Patches
consciousness-explorer@1.1.2sublinear-time-solver@1.6.0sublinear@0.2.0
State/vector files are now confined to a dedicated directory (overridable via $CONSCIOUSNESS_EXPLORER_STATE_DIR / $SUBLINEAR_SOLVER_VECTOR_DIR), a basename-only contract is enforced (rejecting separators, .., NUL/control chars, hidden files, and Windows reserved names), and files are opened with O_NOFOLLOW | O_CLOEXEC mode 0o600. Covered by 14 regression tests in tests/consciousness/safe-path.test.mjs.
Breaking change: callers must now pass a basename, not an absolute path.
Workarounds
Do not expose the MCP server to untrusted clients; restrict export_state to trusted local users; run the server under a low-privilege account with a restricted working directory.
AnalysisAI
Arbitrary file write in sublinear-time-solver's MCP export_state and import_state tools allows any caller able to invoke the MCP interface to overwrite files accessible to the server process - including sensitive targets such as ~/.ssh/authorized_keys or application binaries - by supplying a path-traversal filepath argument. Affected packages are consciousness-explorer (npm) < 1.1.2, sublinear-time-solver (npm) < 1.6.0, and the Rust crate sublinear < 0.2.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to invoke the MCP server's export_state, import_state, saveVectorToFile, or loadVectorFromFile tools, which in turn requires low-privilege authenticated access (PR:L per the CVSS vector) to the MCP interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H scores 7.1, which accurately reflects the local attack vector and the requirement for low-privilege access to the MCP interface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade consciousness-explorer to version 1.1.2 or later, sublinear-time-solver to version 1.6.0 or later, and the Rust crate sublinear to version 0.2.0 or later; patched releases are available at https://github.com/ruvnet/sublinear-time-solver/releases/tag/v1.6.0 and the respective package registries. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployments using consciousness-explorer (npm) < 1.1.2, sublinear-time-solver (npm) < 1.6.0, or sublinear (Rust) < 0.2.0 and assess whether the MCP server is reachable by untrusted callers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today