Executive brief
sublinear-time-solver is a Node.js library used for computational tasks. A path traversal vulnerability in its MCP Interface component allows an attacker to write arbitrary files to the system, potentially overwriting critical application or configuration files and compromising system integrity.
Technical details
The vulnerability is a CWE-22 path traversal issue in the export_state function of src/consciousness-explorer/mcp/server.js. An attacker can manipulate file path inputs to traverse directory boundaries and write files outside the intended directory. The attack is network-accessible, requires no authentication or user interaction, and allows arbitrary file write operations. Version 1.5.0 and earlier are affected. No patch has been released at the time of this advisory.
Affected products
- ruvnet sublinear-time-solver 1.5.0 and earlier
Timeline
- 2026-05-02: disclosed: Vulnerability published in OSV
- 2026-05-07: other: GitHub advisory reviewed