AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-jjhp-8crj-mppq: @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

highvulnerabilityLLM-Specific

security

Source: GitHub Advisory DatabaseSeptember 22, 2026CVE-2026-61647

Summary

A path traversal vulnerability (a security flaw where an attacker can access files outside an intended directory using paths like `../`) existed in the @roomi-fields/notebooklm-mcp tool, allowing attackers or prompt-injected LLMs (large language models controlled through manipulated input) to write files anywhere the server could access. This affected versions 1.6.0 through 2.0.2, and while the written files themselves couldn't execute code, they could be placed in sensitive locations for later exploitation.

Solution / Mitigation

Fixed in v2.0.3. The patch includes: (1) Optional containment via the `NOTEBOOKLM_VAULT_ROOT` environment variable, which restricts file writes relative to a specified root directory and rejects absolute paths or `..` segments outside that root; (2) Sanitization of the `slug_prefix` parameter to strip path separators (`/`, `\`), `..` sequences, and NUL bytes, with a 64-character length cap. For users unable to upgrade immediately, workarounds include running the server under a dedicated unprivileged user with limited write permissions, not exposing the HTTP endpoint beyond localhost, and validating `vault_dir` arguments before forwarding them to the MCP.