CVE-2026-61647: NotebookLM MCP vault export path traversal

Tracking: CVE-2026-61647
Severity: High

Who is affected

@roomi-fields/notebooklm-mcp from 1.6.0 to before 2.0.3. The HTTP /batch-to-vault route arrived in 1.6.0; the corresponding MCP batch tool arrived in 1.7.0. An attacker must reach one of these export paths.

How the attack works

The export accepts an unrestricted vault_dir and a slug_prefix that can traverse directories. A caller can direct Markdown or JSON output to unintended locations that the process may write.

The reported output contains inert exported content. This is an arbitrary-file-write issue; the advisory does not establish direct code execution from the exported text alone.

What to do

1. Upgrade to 2.0.3 or later and explicitly set NOTEBOOKLM_VAULT_ROOT to the permitted vault directory.
2. Verify that exports outside that root are rejected. Without the environment variable, the fixed release preserves legacy unrestricted directory writes; upgrading alone does not enable confinement.
3. Review export requests and unintended .md or .json files. Reduce the runtime account's writable directories.

Scope and limits

The patch always sanitizes slug_prefix, but restricting vault_dir still requires the configured root.

Sources

• Original advisory or incident report