CVE-2026-55609 is a high-severity (CVSS 7.1) CWE-73 vulnerability in consciousness-explorer. O3 Security confirms whether CVE-2026-55609 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-55609.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
consciousness-explorernpmsublinear-time-solvernpmDescription
Impact
An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the consciousness-explorer component of sublinear-time-solver. The MCP export_state (and import_state) tool accepted a user-supplied filepath argument and passed it directly to fs.writeFileSync / fs.readFileSync without constraining the destination or rejecting path traversal. An attacker able to invoke the MCP tool could write or overwrite any file accessible to the server process (e.g. ~/.ssh/authorized_keys, application files), leading to integrity loss and potential service disruption.
The same sink class was present in the main solver MCP server (saveVectorToFile / loadVectorFromFile).
Affected versions
consciousness-explorer< 1.1.2sublinear-time-solver< 1.6.0sublinear(crates.io) < 0.2.0
Patches
State/vector files are now confined to a dedicated directory (overridable via $CONSCIOUSNESS_EXPLORER_STATE_DIR / $SUBLINEAR_SOLVER_VECTOR_DIR), a basename-only contract is enforced (rejecting separators, .., NUL/control chars, hidden files, and Windows reserved names), and files are opened with O_NOFOLLOW | O_CLOEXEC mode 0o600. Covered by 14 regression tests in tests/consciousness/safe-path.test.mjs.
Breaking change: callers must now pass a basename, not an absolute path.
Workarounds
Do not expose the MCP server to untrusted clients; restrict export_state to trusted local users; run the server under a low-privilege account with a restricted working directory.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | consciousness-explorer | all versions | 1.1.2 |
| 📦npm | sublinear-time-solver | all versions | 1.6.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for consciousness-explorer. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update consciousness-explorer to 1.1.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-55609 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-55609 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-55609. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-55609 in your dependencies?
O3 detects CVE-2026-55609 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.