Description

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export_state and import_state tools in src/consciousness-explorer/mcp/server.js pass the attacker-controlled filepath parameter to filesystem operations in src/consciousness-explorer/index.js without restricting the destination or rejecting traversal. The saveVectorToFile and loadVectorFromFile tools in src/mcp/server.ts contain the same sink class through the file_path parameter. An attacker able to invoke the MCP tools can read, write, or overwrite any file accessible to the server process, causing confidentiality and integrity loss and possible service disruption. This issue is fixed in consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-25T19:16:50.160Z",
  "pubdate": "2026-08-25T19:16:50.160Z",
  "executiveSummary": "A critical path traversal vulnerability exists in the consciousness-explorer and sublinear-time-solver libraries, specifically within their Model Context Protocol (MCP) server implementations. The vulnerability arises from improper input validation of file path parameters passed to filesystem operations. By providing maliciously crafted file paths, an attacker can bypass intended directory restrictions to perform arbitrary read, write, or overwrite operations on files accessible to the server process. This flaw poses a severe risk to confidentiality and integrity, as unauthorized actors can extract sensitive data, corrupt configuration files, or potentially disrupt service availability. The vulnerability affects consciousness-explorer versions prior to 1.1.2 and sublinear-time-solver versions prior to 1.6.0. Successful exploitation requires an attacker to possess the ability to invoke the vulnerable MCP tools, granting them the capacity to interact with the underlying filesystem as the server process user.",
  "technicalDetails": "The vulnerability is a classic path traversal (CWE-22) residing in the MCP server integration components of both consciousness-explorer and sublinear-time-solver. In src/consciousness-explorer/mcp/server.js, the export_state and import_state functions accept a user-supplied 'filepath' parameter. Similarly, in src/mcp/server.ts, the saveVectorToFile and loadVectorFromFile tools accept a 'file_path' argument. These inputs are passed directly to filesystem primitives in src/consciousness-explorer/index.js and associated utility modules without undergoing sanitization or path normalization to ensure the destination remains within a confined sandbox or base directory.\nThe exploitation flow begins with the attacker invoking one of the affected MCP tools. By crafting a payload containing directory traversal sequences (such as '../'), an attacker can escape the intended directory structure. When the server process executes a filesystem read or write operation using these unsanitized strings, the operating system resolves the path relative to the process's working directory, allowing the attacker to reference arbitrary files on the system.\nFor write operations, the absence of input validation allows for arbitrary file creation or overwriting of existing sensitive files. An attacker could potentially replace application logic, configuration files, or system artifacts, leading to full system compromise or service disruption. For read operations, the attacker gains the ability to exfiltrate arbitrary files accessible to the server process, including private keys, environment variables, or database credentials. This flaw is inherent in the design of the tools, which treat untrusted MCP input as trusted paths. The vulnerability is present in consciousness-explorer versions prior to 1.1.2 and sublinear-time-solver versions prior to 1.6.0. The exploit requires no authentication beyond access to the MCP server endpoint, assuming the environment allows the attacker to interact with the server's toolset. The impact is elevated by the elevated privileges under which the server process may be running, potentially allowing the attacker to influence files outside the application's immediate directory."
}