AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file…? What should I do?

    An arbitrary file write vulnerability (CWE-73, External Control of File Name or Path) exists in the consciousness-explorer component of sublinear-time-solver.

    Affected: consciousness-explorer < 1.1.2, sublinear-time-solver < 1.6.0, sublinear (crates.io) < 0.2.0. Fixed in: consciousness-explorer@1.1.2, sublinear-time-solver@1.6.0, sublinear@0.2.0. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/08/cve-2026-55609-consciousness-explorer-sublinear-time-solver-sublinear (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: consciousness-explorer < 1.1.2, sublinear-time-solver < 1.6.0, sublinear (crates.io) < 0.2.0. Fixed in: consciousness-explorer@1.1.2, sublinear-time-solver@1.6.0, sublinear@0.2.0.

      • Check your version: run npm ls consciousness-explorer. Versions < 1.1.2 of consciousness-explorer are affected.
      • Check your version: run npm ls sublinear-time-solver. Versions < 1.6.0 of sublinear-time-solver are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install consciousness-explorer@1.1.2 (first patched version 1.1.2).
      2. Upgrade to the fixed version: run npm install sublinear-time-solver@1.6.0 (first patched version 1.6.0).
      3. Do not expose the MCP server to untrusted clients; restrict export_state to trusted local users; run the server under a low-privilege account with a restricted working directory.
      4. Callers must now pass a basename, not an absolute path.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/08/cve-2026-55609-consciousness-explorer-sublinear-time-solver-sublinear (opens external site)

      Did this work for you?

    Add your answer or comment