CVE-2026-61647: Path Traversal Vulnerability in @roomi-fields/notebooklm-mcp Allows Arbitrary File Write
Summary
CVE-2026-61647: The vault_batch MCP tool (and the equivalent POST /batch-to-vault HTTP endpoint) accepted a caller-supplied vault_dir path that was passed directly to path.resolve() + fs.mkdir() with no containment check. Affects @roomi-fields/notebooklm-mcp versions >= 1.6.0, < 2.0.3. Fixed in 2.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @roomi-fields/notebooklm-mcp package is a tool designed for managing and processing notebooks in a multi-user environment. It provides functionalities for batch processing and storing data securely in a vault. However, it has been found to be vulnerable to path traversal attacks, which could allow unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from the vault_batch MCP tool and the POST /batch-to-vault HTTP endpoint, which improperly handle user-supplied paths. The vault_dir parameter is passed directly to file system functions without adequate checks, allowing attackers to write files outside the intended directory. This could lead to sensitive files being created in critical locations, potentially leading to further exploitation in a multi-user context.
How To Fix
Minimum fixed version
2.0.3
This is the first release that contains the fix.
npm install @roomi-fields/notebooklm-mcp@2.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade, consider the following workarounds: 1. Run the MCP server under a dedicated unprivileged user with write access only to the intended vault directory. 2. Do not expose the HTTP /batch-to-vault endpoint beyond localhost. 3. Validate any vault_dir arguments before forwarding them to the MCP.
Conclusion
The @roomi-fields/notebooklm-mcp package has a critical vulnerability that allows path traversal, posing risks of unauthorized file access. It is essential to update to version 2.0.3 or implement workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for @roomi-fields/notebooklm-mcp →
FAQ
CVE-2026-61647 is a vulnerability in the @roomi-fields/notebooklm-mcp package that allows path traversal, enabling arbitrary file writes outside the intended vault directory.
The vulnerability can lead to unauthorized file creation in sensitive locations, which may be exploited in multi-user environments or when untrusted content is processed.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
If you cannot upgrade, consider running the MCP server under an unprivileged user, restricting access to the /batch-to-vault endpoint, and validating user inputs.
