CVE-2026-61647

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also exposed through the batchtovault MCP...

CVE-2026-61647

NotebookLM MCP (an MCP server and HTTP service for Google NotebookLM) versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also reachable via the batch_to_vault MCP tool from version 1.7.0. Attacker-controlled vault_dir and slug_prefix paramete...

CVE-2026-61647 @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also exposed through the batchtovault MCP...

CVE-2026-61647 @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

NotebookLM MCP is an MCP server and HTTP service for interacting with Google NotebookLM and exporting generated content to local vault directories. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability in the POST /batch-to-vault endpoint, also exposed through the batchtovault MCP...