CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export_state and import_state tools in src/consciousness-explorer/mcp/server.js pass the attacker-controlled filepath parameter to filesystem operations in src/consciousness-explorer/index.js without restricting the destination or rejecting traversal. The saveVectorToFile and loadVectorFromFile tools in src/mcp/server.ts contain the same sink class through the file_path parameter. An attacker able to invoke the MCP tools can read, write, or overwrite any file accessible to the server process, causing confidentiality and integrity loss and possible service disruption. This issue is fixed in consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0.

• CWE-73

• https://github.com/BruceJqs/public_exp/issues/32
• https://github.com/ruvnet/sublinear-time-solver/commit/a701296e363192be863e79d788fa268095e3d229
• https://github.com/ruvnet/sublinear-time-solver/commit/ea9a212b69e4449ec443fe088a7aec7546f70b4a
• https://github.com/ruvnet/sublinear-time-solver/issues/19
• https://github.com/ruvnet/sublinear-time-solver/pull/20
• https://github.com/ruvnet/sublinear-time-solver/releases/tag/v1.6.0
• https://github.com/ruvnet/sublinear-time-solver/security/advisories/GHSA-xc9g-j69q-37xw
• https://github.com/BruceJqs/public_exp/issues/32
• https://github.com/ruvnet/sublinear-time-solver/issues/19

Published

Aug 25, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55602http-proxy-middleware is node.js http-proxy middleware. From…8.6
• CVE-2026-55603http-proxy-middleware is node.js http-proxy middleware. From…7.5
• CVE-2026-55604DeepSeek MCP Server is an MCP server for DeepSeek V4. Starti…8.6
• CVE-2026-55605DeepSeek MCP Server is an MCP server for DeepSeek V4. Starti…5.3
• CVE-2026-55607Claude Code is an agentic coding tool. From 2.1.38 until 2.…8.8
• CVE-2026-55608n8n-MCP is an MCP server that provides AI assistants access …5.4
• CVE-2026-5561A vulnerability was determined in Campcodes Complete POS Man…6.3
• CVE-2026-55610InvoiceShelf is an open-source web & mobile app that helps t…8.7
• CVE-2026-55611AnythingLLM is an application that turns pieces of content i…0
• CVE-2026-55615Langroid is a framework for building large-language-model-po…9.2
• CVE-2026-55616Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-55617Hydro is a next-generation high-performance online judge pla…6.9