[ CVE-2026-61647 · Published 21 Sep 2026 ]
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
[ Description ]Official description
NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint, also exposed through the `batch_to_vault` MCP tool beginning in version 1.7.0, because attacker-controlled `vault_dir` and `slug_prefix` values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes `slug_prefix` and supports vault containment when `NOTEBOOKLM_VAULT_ROOT` is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate `vault_dir` values supplied by LLMs processing untrusted content.
[ Fixes ]Fixes and patches
- @roomi-fields/notebooklm-mcp 2.0.3Fixed version · GitHub Advisories · npm package @roomi-fields/notebooklm-mcp: upgrade to 2.0.3 or later (affected >= 1.6.0, < 2.0.3)
[ Packages ]Affected open-source packages
- @roomi-fields/notebooklm-mcp npmAffected >= 1.6.0, < 2.0.3 · fixed in 2.0.3 · GHSA-jjhp-8crj-mppq