Path Traversal Vulnerability in NotebookLM MCP Server by Roomi Fields

CVE-2026-61647

What is CVE-2026-61647?

The NotebookLM MCP server, which provides an interface for Google NotebookLM and handles content exports, contains a path traversal vulnerability in the POST /batch-to-vault endpoint. This issue arises in versions 1.6.0 to 2.0.2 and allows attackers to manipulate the parameters vault_dir and slug_prefix. Consequently, it can enable the unauthorized writing of Markdown and JSON files outside the designated vault directory to arbitrary locations accessible by the server process. While version 2.0.3 offers mitigations through input sanitization and supports vault containment configurations, users unable to upgrade should implement server restrictions by running it in a dedicated unprivileged account, limiting the HTTP interface to localhost, and ensuring careful validation of vault_dir inputs when handling untrusted content.

References