CVE-2026-61647

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61647
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61647.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61647
Aliases
Published
2026-09-21T21:00:58Z
Modified
2026-09-22T11:45:56Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
@roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
Details

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also exposed through the batch_to_vault MCP tool beginning in version 1.7.0, because attacker-controlled vault_dir and slug_prefix values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes slug_prefix and supports vault containment when NOTEBOOKLM_VAULT_ROOT is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate vault_dir values supplied by LLMs processing untrusted content.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61647.json"
}
References

Affected packages

Git / github.com/roomi-fields/notebooklm-mcp

Affected ranges

Type
GIT
Repo
https://github.com/roomi-fields/notebooklm-mcp
Events
Introduced
dbffbf6307bfb3c5a2fcbd19ef458569c8419059
Fixed
13828d9ff3933839ce14c1797d3b20a6bb7694a6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.6.0"
        },
        {
            "fixed":  "2.0.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.6.0
v1.7.0
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v2.*
v2.0.0
v2.0.1
v2.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61647.json"