{"id":"CVE-2026-61647","revision":"36ceb1b152f043b0949f1aca99e5cf9f","records":[{"revision":"36ceb1b152f043b0949f1aca99e5cf9f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-61647","aliases":[],"title":"@roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory","description":"NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint, also exposed through the `batch_to_vault` MCP tool beginning in version 1.7.0, because attacker-controlled `vault_dir` and `slug_prefix` values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes `slug_prefix` and supports vault containment when `NOTEBOOKLM_VAULT_ROOT` is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate `vault_dir` values supplied by LLMs processing untrusted content.","state":0,"publishedAt":"2026-09-21T21:00:58.673+00:00","modifiedAt":"2026-09-22T15:38:52.069+00:00","affected":[{"ecosystem":"Vendor product","name":"notebooklm-mcp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"roomi-fields\",\n                    \"product\": \"notebooklm-mcp\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.6.0, < 2.0.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/roomi-fields/notebooklm-mcp/security/advisories/GHSA-jjhp-8crj-mppq"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-61647","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-61647","identifiers":["CVE-2026-61647"]},"retained":false,"historicalAffected":[]}],"coverage":[]}