CVE-2026-61647 @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-61647?
CVE-2026-61647 is a high-severity vulnerability in roomi-fields notebooklm-mcp, published on 21 Sep 2026.
Official description
NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint, also exposed through the `batch_to_vault` MCP tool beginning in version 1.7.0, because attacker-controlled `vault_dir` and `slug_prefix` values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes `slug_prefix` and supports vault containment when `NOTEBOOKLM_VAULT_ROOT` is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate `vault_dir` values supplied by LLMs processing untrusted content.
Which versions are affected by CVE-2026-61647?
2 open source packages ship an affected version, including @roomi-fields/notebooklm-mcp.
| Package | Affected | Fixed in |
|---|---|---|
@roomi-fields/notebooklm-mcp npm | From 1.6.0 | 2.0.3 |
@roomi-fields/notebooklm-mcp npm | From 1.6.0 | 2.0.3 |
How do I fix CVE-2026-61647?
Upgrade @roomi-fields/notebooklm-mcp to 2.0.3 or later.
Is CVE-2026-61647 being exploited?
There is no known exploitation of CVE-2026-61647 in the wild and no public exploit code.
Sources
Also known as GHSA-jjhp-8crj-mppq.