CVE-2026-55609

Name of the Vulnerable Software and Affected Versions consciousness-explorer versions prior to 1.1.2 sublinear-time-solver versions prior to 1.6.0

Description An issue exists where the export state and import state tools in src/consciousness-explorer/mcp/server.js pass the attacker-controlled filepath parameter to filesystem operations in src/consciousness-explorer/index.js without restricting the destination or rejecting traversal. Similarly, the saveVectorToFile and loadVectorFromFile tools in src/mcp/server.ts contain the same sink through the file path parameter. An attacker capable of invoking the MCP tools can read, write, or overwrite any file accessible to the server process, leading to loss of confidentiality and integrity, as well as potential service disruption.

Recommendations Update consciousness-explorer to version 1.1.2. Update sublinear-time-solver to version 1.6.0.