---
id: CVE-2026-61647
title: >-
  NotebookLM MCP is an MCP server and HTTP service for interacting with Google
  NotebookLM and exporting generated content to local vault directories
summary: >-
  NotebookLM MCP is an MCP server and HTTP service for interacting with Google
  NotebookLM and exporting generated content to local vault directories.
  Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the
  `POST /batch-t…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-22
  - CWE-73
vendor: roomi-fields
product: notebooklm-mcp
affected:
  - 'notebooklm-mcp >= 1.6.0, < 2.0.3'
patched:
  - '@roomi-fields/notebooklm-mcp 2.0.3'
published: '2026-09-21'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:25:27.050'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61647'
references:
  - url: >-
      https://github.com/roomi-fields/notebooklm-mcp/security/advisories/GHSA-jjhp-8crj-mppq
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61647'
  - url: 'https://github.com/roomi-fields/notebooklm-mcp/issues/15'
  - url: >-
      https://github.com/roomi-fields/notebooklm-mcp/commit/13828d9ff3933839ce14c1797d3b20a6bb7694a6
  - url: 'https://github.com/roomi-fields/notebooklm-mcp/releases/tag/v2.0.3'
  - url: 'https://github.com/advisories/GHSA-jjhp-8crj-mppq'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
epss: 0.00324
epssPercentile: 0.22708
aliases:
  - GHSA-jjhp-8crj-mppq
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T14:12:13.933708Z'
cvssSource: cna
ingestedAt: '2026-09-21T21:53:57.419Z'
---

## Overview

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint, also exposed through the `batch_to_vault` MCP tool beginning in version 1.7.0, because attacker-controlled `vault_dir` and `slug_prefix` values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes `slug_prefix` and supports vault containment when `NOTEBOOKLM_VAULT_ROOT` is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate `vault_dir` values supplied by LLMs processing untrusted content.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61647)

Affected packages:

- `@roomi-fields/notebooklm-mcp >= 1.6.0, < 2.0.3`

Patched in:

- `@roomi-fields/notebooklm-mcp 2.0.3`

Source: https://github.com/advisories/GHSA-jjhp-8crj-mppq