CVE-2026-55609: Arbitrary File Read and Write via Model Context Protocol (MCP) Tools in sublinear-time-solver and consciousness-explorer

The Model Context Protocol (MCP) server implementations in sublinear-time-solver (specifically version 1.5.0) and its companion library consciousness-explorer (specifically version 1.1.1) expose operational endpoints designed to facilitate state and vector calculations. These endpoints are accessible as specialized tools named export_state, import_state, saveVectorToFile, and loadVectorFromFile.

These components accept user-provided path parameters without enforcing structural directory restrictions. Consequently, the exposed attack surface allows any user or local process capable of communicating with the MCP interface to interact directly with filesystem components under the privileges of the running application process.

This vulnerability is classified under CWE-73 (External Control of File Name or Path). The lack of absolute restriction and path validation permits attackers to perform read and write operations, leading to complete compromise of integrity and confidentiality on the local filesystem.

The root cause of this vulnerability lies in the direct transmission of user-controlled input paths to low-level filesystem interfaces. In consciousness-explorer (<= 1.1.1), the export_state and import_state tools expose an execution parameter named filepath. This string variable is handled directly by the system APIs without sanitization.

When a request is submitted, the code resolves the input path using standard filesystem utilities and executes direct IO actions such as fs.writeFileSync(filepath, JSON.stringify(state)). Because these tools do not perform bounds checking or relative path normalization, an attacker can input parent directory patterns (../) or absolute path structures to navigate beyond the workspace scope.

Similarly, in sublinear-time-solver (<= 1.5.0), the tools saveVectorToFile and loadVectorFromFile dynamically resolve path parameters using path.resolve(filePath). The program then invokes recursive folder creation followed by file reads or writes. If an attacker directs this path to systemic configurations, files will be read or overwritten silently.

In the vulnerable version of consciousness-explorer (src/consciousness-explorer/index.js), the state-saving logic relies entirely on the client's input validation:

// Vulnerable Implementation
async exportState(filepath) {
    const fs = await import('fs');
    fs.writeFileSync(filepath, JSON.stringify(state, null, 2));
    return state;
}

The corresponding patch addresses this deficiency by creating a dedicated verification helper named resolveVectorPath within a newly introduced security file (safe-path.ts / safe-path.js). This module validates the structural safety of the incoming parameter before interacting with filesystem resources:

// Patched Implementation (safe-path.ts)
export function resolveVectorPath(
  filename: unknown,
  options: { stateDir?: string } = {},
): string {
  assertSafeBasename(filename);
  const stateDir = options.stateDir ?? DEFAULT_VECTOR_DIR;
  const baseAbs = path.resolve(stateDir);
  fs.mkdirSync(baseAbs, { recursive: true, mode: 0o700 });
  const candidate = path.resolve(baseAbs, filename as string);
  const rel = path.relative(baseAbs, candidate);
  if (rel.startsWith('..') || path.isAbsolute(rel) || rel.includes(`..${path.sep}`)) {
    throw new SafePathError(`resolved path "${candidate}" escapes vector dir "${baseAbs}"`);
  }
  return candidate;
}

The remediated implementation establishes an anchor path (baseAbs) and evaluates the candidate output path relative to this anchor. The directory confinement checks guarantee that if the output attempts to escape the root directory using relative patterns, an error is triggered, immediately halting execution.

To execute this vulnerability, an attacker must craft JSON-RPC requests directed at the local MCP server endpoint. Because the software interacts natively with LLM applications, exploitation can occur locally or via malicious system instructions delivered to integrated agents.

For an arbitrary file write attack, the client submits a JSON payload to invoke the export_state tool, defining a destination directory such as /tmp/sublinear_state_poc.json to prove the ability to write files outside of the intended state boundaries:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "export_state",
    "arguments": {
      "filepath": "/tmp/sublinear_state_poc.json"
    }
  }
}

For an arbitrary file read attack, the attacker calls the loadVectorFromFile tool and provides directory traversal variables to point to sensitive server configurations or operating system databases:

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "loadVectorFromFile",
    "arguments": {
      "file_path": "../../../../../../etc/passwd"
    }
  }
}

When the application processes this traversal request, it reads the contents of the target system file and packages it directly inside the RPC response, facilitating data exfiltration.

The impact of CVE-2026-55609 is substantial. Successful exploitation allows unauthorized read and write access to files accessible under the host system permissions of the running application. Attackers can leverage the writing capabilities to modify configuration structures, drop administrative authorization configurations, or overwrite executable files.

The arbitrary file reading capabilities also present confidentiality exposures. Sensitive database environments, keys, and operational files can be systematically harvested from vulnerable container containers.

When this application interacts with AI-driven models or automated agents, the risk is amplified. An external agent could manipulate the model context to invoke filesystem utilities with engineered path variables, bridging application security domains and leading to indirect code execution.

To mitigate this vulnerability, system administrators and developers must update dependencies immediately. Ensure that sublinear-time-solver is updated to version 1.6.0 or higher, and consciousness-explorer is updated to version 1.1.2 or higher.

If instant upgrades are not feasible within your system architecture, the following host-level controls must be applied:

• Run the underlying application using a dedicated, non-privileged system user profile to reduce the scope of directory modifications.

• Use network segmentation rules to block the MCP interfaces from accepting non-local connections.

• Explicitly configure secure isolation pathways by setting the target environment variables SUBLINEAR_SOLVER_VECTOR_DIR and CONSCIOUSNESS_EXPLORER_STATE_DIR to isolated, sandboxed directories.