CVE-2026-61647

Received Received - Intake

Path Traversal in NotebookLM MCP Server

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint, also exposed through the `batch_to_vault` MCP tool beginning in version 1.7.0, because attacker-controlled `vault_dir` and `slug_prefix` values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes `slug_prefix` and supports vault containment when `NOTEBOOKLM_VAULT_ROOT` is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate `vault_dir` values supplied by LLMs processing untrusted content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-61647

Affected Vendors & Products

Vendor	Product	Version / Range
google	notebooklm	From 1.6.0 (inc) to 2.0.2 (inc)
google	notebooklm	From 1.7.0 (inc)
google	notebooklm	2.0.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

NotebookLM MCP versions 1.6.0 through 2.0.2 have a path traversal flaw in the POST /batch-to-vault endpoint and batch_to_vault MCP tool. Attackers can manipulate vault_dir and slug_prefix parameters to write files outside the intended vault directory to any location the server process can access.

Detection Guidance

Check if NotebookLM MCP versions 1.6.0 through 2.0.2 are running. Inspect HTTP traffic for POST requests to /batch-to-vault with suspicious vault_dir or slug_prefix values. Review file system writes outside intended vault directories.

Impact Analysis

An attacker could overwrite sensitive files, plant malicious content, or gain unauthorized access to system files. This could lead to data breaches, system compromise, or further attacks if the server runs with elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Upgrade to version 2.0.3 or later. Configure NOTEBOOKLM_VAULT_ROOT to enforce vault containment. Run the server as an unprivileged user restricted to the vault directory. Limit HTTP endpoint access to localhost only.

Hi! I’m here to help you understand CVE-2026-61647. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70