Read the docs
TI-2026-44150 Aliases CVE-2026-61647GHSA-jjhp-8crj-mppq

Path traversal in roomi-fields notebooklm-mcp

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint, also exposed through the `batch_to_vault` MCP tool beginning in version 1.7.0, because attacker-controlled `vault_dir` and `slug_prefix` values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes `slug_prefix` and supports vault containment when `NOTEBOOKLM_VAULT_ROOT` is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate `vault_dir` values supplied by LLMs processing untrusted content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Fix Fixed notebooklm-mcp (roomi-fields): 2.0.3@roomi-fields/notebooklm-mcp (npm): 2.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
roomi-fieldsnotebooklm-mcp1.6.0 to before 2.0.32.0.3Patch availableCNA
—@roomi-fields/notebooklm-mcp (npm)1.6.0 to before 2.0.32.0.3Patch availableGHSA-jjhp-8crj-mppq
  • notebooklm-mcp Vendorroomi-fields Affected 1.6.0 to before 2.0.3 Fixed in 2.0.3 Patch available CNA
  • @roomi-fields/notebooklm-mcp (npm) Vendor— Affected 1.6.0 to before 2.0.3 Fixed in 2.0.3 Patch available GHSA-jjhp-8crj-mppq

Remediation

  • Fix · CNA notebooklm-mcp (roomi-fields) Fixed in 2.0.3
  • Fix · GHSA-jjhp-8crj-mppq @roomi-fields/notebooklm-mcp (npm) Fixed in 2.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61647
  2. 2026-10-03 Alias added: GHSA-jjhp-8crj-mppq

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences