CVE-2026-55609: 
JavaScript Análisis y mitigación de vulnerabilidades

CVE-2026-55609 is an arbitrary file write vulnerability (CWE-73: External Control of File Name or Path) affecting the consciousness-explorer and sublinear-time-solver npm packages by ruvnet. The flaw exists in the MCP (Model Context Protocol) server tools export_state/import_state in src/consciousness-explorer/mcp/server.js and saveVectorToFile/loadVectorFromFile in src/mcp/server.ts, which pass attacker-controlled filepath parameters directly to filesystem operations without path validation. Affected versions are consciousness-explorer < 1.1.2, sublinear-time-solver < 1.6.0, and sublinear (crates.io) < 0.2.0. The vulnerability was discovered by independent researcher BruceJin on April 17, 2026, and publicly disclosed via GitHub Security Advisory GHSA-xc9g-j69q-37xw on August 25, 2026. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is CWE-73 (External Control of File Name or Path): the MCP export_state tool at src/consciousness-explorer/mcp/server.js:239 accepts a user-supplied filepath argument and passes it directly to fs.writeFileSync(filepath, JSON.stringify(state, null, 2)) at src/consciousness-explorer/index.js:288 without constraining the destination directory or rejecting path traversal sequences such as ../, absolute paths, or symlinks. The same sink class exists in src/mcp/server.ts where saveVectorToFile calls path.resolve(filePath) followed by fs.writeFileSync, and loadVectorFromFile calls fs.readFileSync(path.resolve(filePath)), both with attacker-controlled input. An attacker with the ability to invoke the MCP tools — requiring only local access with low privileges — can supply arbitrary paths (e.g., ~/.ssh/authorized_keys, /etc/hosts) as the filepath argument to read or overwrite any file accessible to the server process. Discovery was performed via static analysis (CodeQL), source-code audit, and manual reproduction using mcp-inspector (GitHub Advisory, Researcher PoC).

Successful exploitation allows an attacker to write or overwrite any file accessible to the MCP server process, resulting in high integrity and availability impact. Critical targets include SSH authorized keys (~/.ssh/authorized_keys), application binaries, configuration files, and /etc/hosts, enabling privilege escalation, persistent backdoor installation, or service disruption. While confidentiality impact is rated None for the primary export_state write path, the loadVectorFromFile and importState read sinks also allow arbitrary file reads, creating a secondary risk of sensitive data exfiltration. The scope is unchanged (limited to the server process's privilege level), but the consequences can be severe depending on the account under which the MCP server runs (GitHub Advisory, Fix PR).

A public proof-of-concept (PoC) was included in the researcher's disclosure, demonstrating exploitation via a crafted JSON-RPC request to the MCP export_state tool with an arbitrary filepath argument, manually confirmed using mcp-inspector. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to invoke MCP tools, limiting the attack surface to environments where the MCP server is exposed to untrusted local users or accessible via a remotely reachable MCP bridge (GitHub Advisory, Researcher PoC).

1. Identify target: Locate a system running consciousness-explorer < 1.1.2 or sublinear-time-solver < 1.6.0 with the MCP server accessible (locally or via an MCP bridge).
2. Start MCP server: The MCP server is started via Node.js (e.g., node -e importing ConsciousnessExplorer and calling startMCPServer(), or via mcp-inspector).
3. Craft malicious JSON-RPC request: Construct a tools/call request targeting the export_state tool with an attacker-controlled filepath pointing to a sensitive file:

   {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"export_state","arguments":{"filepath":"/home/user/.ssh/authorized_keys"}}}

4. Send request: Submit the request to the MCP server endpoint. The server passes filepath directly to fs.writeFileSync(filepath, JSON.stringify(state, null, 2)) without validation.
5. Achieve arbitrary file write: The server overwrites the target file (e.g., ~/.ssh/authorized_keys) with JSON state data, enabling SSH key injection, service disruption, or further privilege escalation.
6. Optional — arbitrary file read: Use the import_state or loadVectorFromFile tools with a sensitive filepath (e.g., /etc/passwd) to exfiltrate file contents via the read sink (Researcher PoC, GitHub Advisory).

• Logs: MCP server logs showing export_state, import_state, saveVectorToFile, or loadVectorFromFile tool invocations with filepath or file_path arguments containing absolute paths (e.g., /home/, /etc/, /root/, ~/.ssh/), path traversal sequences (../), or paths outside the expected state directory.
• File System: Unexpected modification timestamps on sensitive files such as ~/.ssh/authorized_keys, /etc/hosts, or application configuration files; new JSON-formatted files in unexpected locations (content will be JSON state data from the consciousness-explorer); state directory (~/.consciousness-explorer/state or ~/.sublinear-time-solver/vectors) absent while state files appear elsewhere.
• Process: Node.js MCP server process (node) performing file writes to paths outside its expected working directory or state directory, observable via auditd, inotifywait, or similar file integrity monitoring tools.
• Network: If the MCP server is exposed via a bridge, unusual JSON-RPC tools/call requests to export_state or saveVectorToFile with non-basename filepath values in network traffic captures (GitHub Advisory, Fix PR).

Upgrade to the patched versions: consciousness-explorer@1.1.2, sublinear-time-solver@1.6.0, and sublinear@0.2.0 (crates.io). The fix introduces safe-path helpers that enforce a basename-only contract (rejecting path separators, .., leading dots, NUL/control characters, and Windows reserved names), confine state/vector files to dedicated directories (~/.consciousness-explorer/state and ~/.sublinear-time-solver/vectors, overridable via environment variables), and open files with O_NOFOLLOW | O_CLOEXEC at mode 0o600. Note this is a breaking change: callers must now pass a basename rather than an absolute path. If immediate upgrade is not possible, do not expose the MCP server to untrusted clients, restrict export_state access to trusted local users only, and run the server under a low-privilege account with a restricted working directory and filesystem permissions that prevent writes to sensitive locations (GitHub Advisory, Fix PR).

The vulnerability was credited to independent researcher BruceJin (brucejin@zju.edu.cn) from Zhejiang University, who discovered it via static analysis using CodeQL and manual reproduction with mcp-inspector. The maintainer (ruvnet) responded promptly, merging a comprehensive fix (PR #20) that addressed not only the originally reported sink but also two additional undisclosed sinks (importState and the main MCP server's saveVectorToFile/loadVectorFromFile). The fix was reviewed and patched with assistance from claude-flow (an AI-assisted code review tool), and includes 14 regression tests covering the CWE-73 sink class (GitHub Advisory, Fix PR).