High, CVSS 7.1npmAmendedPublished
@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
CVE-2026-61647 · GHSA-jjhp-8crj-mppq
- Affected
- npm @roomi-fields/notebooklm-mcp >= 1.6.0, < 2.0.3
- Fixed in
- 2.0.3· Vendor fix available
- Issue
- The vaultbatch MCP tool (and the equivalent POST /batch-to-vault HTTP endpoint) accepted a caller-supplied vaultdir path that was passed directly to path.resolve() + fs.mkdir() with no containment check. A caller — or a prompt-injected LLM driving the MCP — could therefore create directories and write .md / .json answer files anywhere the server process can write. The slugprefix parameter had a parallel, smaller traversal vector: it was concatenated into the filename without sanitization, so a prefix containing / or .. could escape the resolved vault directory through the filename component. Impact File write (markdown + JSON sidecars) to any location writable by the server process. The written files are inert content (no code execution by themselves), but in a multi-user context — or when the MCP server is driven by an LLM that has read untrusted content (prompt injection) — this allows an attacker to plant files in sensitive locations (autostart folders, shell startup…
Recommended action: Upgrade to 2.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.