CVE-2026-55609: CWE-73: External Control of File Name or Path in ruvnet sublinear-time-solver

The vulnerability involves external control of file name or path (CWE-73) in the sublinear-time-solver library and related consciousness-explorer tools. Specifically, the export_state and import_state tools in src/consciousness-explorer/mcp/server.js and the saveVectorToFile and loadVectorFromFile tools in src/mcp/server.ts pass attacker-controlled file path parameters to filesystem operations without proper restrictions or traversal rejection. This allows an attacker able to invoke these MCP tools to manipulate arbitrary files accessible by the server process. The vulnerability is resolved in consciousness-explorer version 1.1.2 and sublinear-time-solver version 1.6.0.

An attacker with the ability to invoke the MCP tools can read, write, or overwrite any file accessible to the server process. This leads to loss of data integrity and confidentiality, and may also cause service disruption. The CVSS 3.1 base score is 7.1 (high), reflecting local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

This vulnerability is fixed in consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0. Users should upgrade to these versions or later to remediate the issue. No other mitigation or temporary workaround is indicated in the available data.