NotebookLM MCP is a server and HTTP service for Google NotebookLM content export. Versions 1.6.0 through 2.0.2 contain a path traversal vulnerability (CWE-22) in the POST /batch-to-vault endpoint and the batch_to_vault MCP tool (from 1.7.0). This vulnerability arises because attacker-controlled 'vault_dir' and 'slug_prefix' parameters can cause Markdown and JSON files to be written outside the intended vault directory to any location writable by the server process. Version 2.0.3 mitigates this by sanitizing 'slug_prefix' and enabling vault containment when the environment variable NOTEBOOKLM_VAULT_ROOT is set. If this variable is unset, containment is not enforced. The vulnerability has a CVSS 4.0 score of 7.1 (high severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity.

An attacker can exploit this vulnerability to write files outside the designated vault directory, potentially overwriting or creating files in arbitrary locations writable by the server process. This can lead to unauthorized file manipulation and compromise of system integrity. The vulnerability does not require user interaction or elevated privileges, increasing its risk. However, no known exploits are reported in the wild.

Version 2.0.3 of notebooklm-mcp provides an official fix by sanitizing the 'slug_prefix' parameter and supporting vault containment when the NOTEBOOKLM_VAULT_ROOT environment variable is configured. Users should upgrade to version 2.0.3 or later to fully mitigate this issue. For users unable to upgrade immediately, it is recommended to run the server under a dedicated unprivileged account restricted to the intended vault directory, limit the HTTP endpoint to localhost access only, and validate 'vault_dir' values supplied by LLMs processing untrusted content. Patch status is confirmed by vendor advisory details.