NotebookLM MCP CVE-2026-61647

Requires the caller to reach the POST /batch-to-vault HTTP endpoint (present since 1.6.0) or the batch_to_vault MCP tool (since 1.7.0) and to control the vault_dir and/or slug_prefix values. Exploitation is UNLIMITED by containment in default deployments because vault confinement only activates when NOTEBOOKLM_VAULT_ROOT is set, which is unset by default. Limiting factors: CVSS PR:L implies some access/authentication to the service, the vendor recommends binding the HTTP endpoint to localhost (reducing remote reach), and in the MCP path an attacker must influence an LLM that is processing untrusted content into invoking the tool with malicious paths. Affects versions 1.6.0 through 2.0.2; fixed in 2.0.3.

This is a moderate-severity path traversal (CWE-22) rated 7.1 by the vendor under CVSS 4.0 (AV:N/AC:L/PR:L/UI:N/VC:N/VI:H/VA:N), with impact confined to integrity - the flaw enables arbitrary file WRITE (Markdown/JSON) to any location writable by the server process, not disclosure. No EPSS score, CISA KEV listing, or public exploit code is present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The single reference is the GitHub Security Advisory (GHSA-jjhp-8crj-mppq) that assigned the CVE. The real-world priority is TEMPERED by product footprint (an obscure open-source MCP integration tool) and by exploitation prerequisites: the CVSS PR:L indicates the caller must be at least a low-privileged/authenticated actor, and the vendor explicitly recommends limiting the HTTP endpoint to localhost. One conflicting signal worth noting: the vendor scored availability as VA:N, yet arbitrary file write to any server-writable path could plausibly overwrite critical files (config, code) and escalate to code execution or denial of service - verify with the vendor whether the integrity-only scoring understates real impact. Net: a legitimate flaw worth patching for anyone running this tool, but not a broad-fleet emergency given low prevalence and no exploitation evidence.

An actor able to reach the localhost-exposed HTTP service, or an LLM coaxed into calling the batch_to_vault MCP tool while processing untrusted content, supplies a vault_dir or slug_prefix containing traversal sequences (e.g. ../../). The server writes generated Markdown/JSON outside the intended vault to any path it can write - for example overwriting a cron job, startup script, or application config to achieve tampering or code execution. No public proof-of-concept is identified in the provided data.