CVE-2026-61647: NotebookLM MCP: path traversal enables arbitrary file write

Q: Is CVE-2026-61647 actively exploited?

No confirmed active exploitation of CVE-2026-61647 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-61647?

1) Upgrade @roomi-fields/notebooklm-mcp to 2.0.3 or later. 2) Set NOTEBOOKLM_VAULT_ROOT to the intended vault directory, since containment is disabled without it. 3) Run the server as a dedicated unprivileged account whose write access is limited to the vault. 4) Bind the HTTP endpoint to localhost only and do not expose it through proxies or tunnels. 5) Validate or constrain vault_dir values that LLMs supply, and require human approval for batch_to_vault calls in agents that process untrusted content. 6) Detect: monitor for POST /batch-to-vault requests with vault_dir or slug_prefix containing '..' or absolute paths, and for unexpected .md or .json files created outside the vault, especially in agent config, shell profile or startup directories. 7) Inventory installs with npm ls across developer machines and CI.

Q: What systems are affected by CVE-2026-61647?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, knowledge management and note export pipelines.

Q: What is the CVSS score for CVE-2026-61647?

No CVSS score has been assigned yet.

GHSA-jjhp-8crj-mppqHIGH

Published September 21, 2026

CISO Take

NotebookLM MCP (npm @roomi-fields/notebooklm-mcp, versions 1.6.0 to 2.0.2) has a path traversal flaw in its batch-to-vault export. Attacker-controlled vault_dir and slug_prefix values let Markdown and JSON files be written anywhere the server process can write. Immediate risk is moderate: there is no public exploit, no Nuclei template, no KEV listing, CISA SSVC says TRACK, and EPSS is low (0.00324, roughly the top 77th percentile). The AI-specific danger is that an LLM agent processing untrusted content can be prompt-injected into supplying a malicious vault_dir through the MCP tool, so no direct network access is needed. The package has about 3,047 dependents and a mediocre OpenSSF score of 5.8/10, with 68 other CVEs on record, so supply-chain exposure is real. Upgrade to 2.0.3 and set NOTEBOOKLM_VAULT_ROOT, because containment is off when that variable is unset.

Sources:NVDEPSSGitHub AdvisoryATLASOpenSSF

What is the risk?

Medium-high. Exploitation is simple once the attacker can influence the endpoint or the tool arguments, and the impact is arbitrary file write, with a path to code execution if the process can write to startup scripts, shell profiles, cron entries or agent configuration files. Written content is limited to Markdown and JSON, which constrains direct code execution. Exposure is highest when the HTTP service is bound beyond localhost or when the MCP tool is used by agents that ingest untrusted content. EPSS is low, with no public exploit or KEV listing, so mass exploitation is unlikely in the near term. The patch alone does not fix the issue: containment depends on the NOTEBOOKLM_VAULT_ROOT variable being configured.

How does the attack unfold?

Initial Access

Attacker reaches the exposed HTTP endpoint or plants a prompt injection in content the agent processes.

AML.T0051.001

Tool Invocation

The agent or attacker calls batch_to_vault with a crafted vault_dir or slug_prefix containing traversal sequences.

AML.T0053

Exploitation

The server writes Markdown and JSON files outside the vault to any location writable by its process.

AML.T0049

Impact

Overwritten or planted files tamper with agent configuration or data, enabling persistence or escalation to code execution.

AML.T0081

Initial Access

Attacker reaches the exposed HTTP endpoint or plants a prompt injection in content the agent processes.

AML.T0051.001

Tool Invocation

The agent or attacker calls batch_to_vault with a crafted vault_dir or slug_prefix containing traversal sequences.

AML.T0053

Exploitation

The server writes Markdown and JSON files outside the vault to any location writable by its process.

AML.T0049

Impact

Overwritten or planted files tamper with agent configuration or data, enabling persistence or escalation to code execution.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter Notebook	npm	>= 1.6.0, < 2.0.3	`2.0.3`
13.5KOpenSSF 5.83.0K dependentsPushed 7d ago79% patched~75d to patchFull package profile →

Do you use Jupyter Notebook? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade @roomi-fields/notebooklm-mcp to 2.0.3 or later. 2) Set NOTEBOOKLM_VAULT_ROOT to the intended vault directory, since containment is disabled without it. 3) Run the server as a dedicated unprivileged account whose write access is limited to the vault. 4) Bind the HTTP endpoint to localhost only and do not expose it through proxies or tunnels. 5) Validate or constrain vault_dir values that LLMs supply, and require human approval for batch_to_vault calls in agents that process untrusted content. 6) Detect: monitor for POST /batch-to-vault requests with vault_dir or slug_prefix containing '..' or absolute paths, and for unexpected .md or .json files created outside the vault, especially in agent config, shell profile or startup directories. 7) Inventory installs with npm ls across developer machines and CI.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionPrompt InjectionPluginAgentAPIAML.T0049- Exploit Public-Facing Application AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0081- Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-61647?

Is CVE-2026-61647 actively exploited?

No confirmed active exploitation of CVE-2026-61647 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-61647?

1) Upgrade @roomi-fields/notebooklm-mcp to 2.0.3 or later. 2) Set NOTEBOOKLM_VAULT_ROOT to the intended vault directory, since containment is disabled without it. 3) Run the server as a dedicated unprivileged account whose write access is limited to the vault. 4) Bind the HTTP endpoint to localhost only and do not expose it through proxies or tunnels. 5) Validate or constrain vault_dir values that LLMs supply, and require human approval for batch_to_vault calls in agents that process untrusted content. 6) Detect: monitor for POST /batch-to-vault requests with vault_dir or slug_prefix containing '..' or absolute paths, and for unexpected .md or .json files created outside the vault, especially in agent config, shell profile or startup directories. 7) Inventory installs with npm ls across developer machines and CI.

What systems are affected by CVE-2026-61647?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling LLM agents, knowledge management and note export pipelines.

What is the CVSS score for CVE-2026-61647?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling LLM agentsknowledge management and note export pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0081Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05, LLM06

What are the technical details?

Original Advisory

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the `POST /batch-to-vault` endpoint, also exposed through the `batch_to_vault` MCP tool beginning in version 1.7.0, because attacker-controlled `vault_dir` and `slug_prefix` values can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 sanitizes `slug_prefix` and supports vault containment when `NOTEBOOKLM_VAULT_ROOT` is configured; containment is not enabled if that variable is unset. Users unable to upgrade should run the server as a dedicated unprivileged account restricted to the intended vault, keep the HTTP endpoint limited to localhost, and validate `vault_dir` values supplied by LLMs processing untrusted content.

Exploitation Scenario

An attacker plants hidden instructions in a document or web page that a user's AI agent summarizes with NotebookLM MCP available. The injected prompt tells the agent to call batch_to_vault with a vault_dir pointing at a sensitive location, or a slug_prefix with ../ sequences, such as an agent configuration directory or a project's JSON config. The server writes attacker-influenced JSON or Markdown there, overwriting or adding files that alter agent behavior, add malicious MCP server definitions or inject persistent instructions. Alternatively, an attacker with network reach to an HTTP endpoint exposed beyond localhost calls POST /batch-to-vault directly.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted DirectoryPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-73External Control of File Name or PathPrimary CWE-73External Control of File Name or PathPrimary CWE-22Improper Limitation of a Pathname to a Restricted Directory CWE-73External Control of File Name or Path

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.