GHSA-jjhp-8crj-mppq: @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

Summary

The vault_batch MCP tool and the POST /batch-to-vault HTTP endpoint in @roomi-fields/notebooklm-mcp passed a caller-supplied vault_dir directly to path.resolve() and fs.mkdir() with no containment check, and slug_prefix was concatenated into filenames without sanitization. Affected versions run from v1.6.0 through v2.0.2, and an attacker, or a prompt-injected LLM driving the MCP, could write .md and .json files to any location the server process can write, such as autostart folders or shell startup files.

Mitigation

Fixed in v2.0.3: set the NOTEBOOKLM_VAULT_ROOT environment variable to a directory that bounds all vault writes, which enables realpath-based containment, since it is unset by default and the legacy unrestricted behaviour remains when it is unset. slug_prefix is now always sanitized regardless of that variable. Users who cannot upgrade should run the server under a dedicated unprivileged user with write access only to the intended vault directory, keep the HTTP endpoint off non-localhost interfaces, and validate vault_dir arguments before forwarding them.

Topics

• Model Context Protocol

Related items

• HighCVE-2026-125271 - AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationSimilar attack · AWS Security Bulletins
• HighGHSA-ghwv-vrp2-2975: Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU AttacksSimilar attack · GitHub Advisory Database
• MediumGHSA-5m6c-38r8-5w76: Dagu MCP DAG specification read bypasses path containment and workspace isolationSimilar attack · GitHub Advisory Database
• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database