@roomi-fields/notebooklm-mcp vault.batch path traversal allows file writes outside the vault
- Product
- @roomi-fields/notebooklm-mcp
- CVE
- CVE-2026-61647
- Affected
- npm/@roomi-fields/notebooklm-mcp 1.6.0 to 2.0.2
- Fixed in
- 2.0.3
Last verified against sources: October 26, 2026
Am I affected?
@roomi-fields/notebooklm-mcp: affected npm/@roomi-fields/notebooklm-mcp 1.6.0 to 2.0.2. Fixed in 2.0.3.
- Check your version: run
npm ls @roomi-fields/notebooklm-mcp. Versions >= 1.6.0, < 2.0.3 of @roomi-fields/notebooklm-mcp are affected. [1]
What to do now
- Upgrade to the fixed version: run
npm install @roomi-fields/notebooklm-mcp@2.0.3(first patched version 2.0.3). [1] - Upgrade to v2.0.3. [1]
- Set NOTEBOOKLM_VAULT_ROOT in the server environment to a directory that should bound all vault writes. [1]
- If you cannot upgrade, run the MCP server under a dedicated unprivileged user with write access only to the intended vault directory. [1]
- Do not expose the HTTP /batch-to-vault endpoint beyond localhost. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- The vault_batch MCP tool took a vault_dir path from the caller and used it directly, with no check that it stayed inside the intended vault directory. [1]
- The same logic was also reachable through the POST /batch-to-vault HTTP endpoint. [1]
- The slug_prefix parameter was joined into the file name without cleaning, so a prefix containing "/" or ".." could escape the vault directory. [1]
- The flaw was present from v1.6.0 and v1.7.0 through v2.0.2. [1]
Impact
- A caller could create directories and write .md and .json answer files anywhere the server process can write. [1]
- The written files are inert content and do not run code by themselves. [1]
- An attacker could plant files in sensitive places such as autostart folders and shell startup files for later abuse. [1]
- A prompt-injected LLM driving the MCP server could also trigger the writes. [1]
What was done
- The issue is fixed in v2.0.3. [1]
- v2.0.3 adds opt-in containment through the NOTEBOOKLM_VAULT_ROOT environment variable; when it is set, vault_dir is resolved relative to that root and realpath-based containment is enforced. [1]
- slug_prefix is now always cleaned: path separators, ".." sequences and NUL bytes are stripped, and the length is capped at 64 characters. [1]
- v2.0.3 keeps the old unrestricted behaviour when NOTEBOOKLM_VAULT_ROOT is not set. [1]
Sources
- GHSA-jjhp-8crj-mppq — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-61647] @roomi-fields/notebooklm-mcp vault.batch path traversal allows file writes outside the vault
Product: @roomi-fields/notebooklm-mcp | Affected: npm/@roomi-fields/notebooklm-mcp 1.6.0 to 2.0.2 | Fixed in: 2.0.3
Summary: The vault_batch MCP tool took a vault_dir path from the caller and used it directly, with no check that it stayed inside the intended vault directory.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/09/cve-2026-61647-roomi-fields-notebooklm-mcpCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-61647
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.