A path traversal vulnerability exists in UsamaK98 python-notebook-mcp up to commit a05a232815809a7e425b5fa7be26e0d4369894c2, specifically in the create_notebook, read_notebook, edit_cell, and add_cell functions of server.py. This vulnerability allows remote attackers to manipulate file paths to access files outside the intended directory. The project follows a rolling release model, so no fixed version is identified, and the vendor has not yet responded with a patch or mitigation. Exploit code is publicly available.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to read or manipulate files on the server by exploiting path traversal in notebook management functions. This could lead to unauthorized disclosure or modification of sensitive data. However, no confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected functions and monitor for updates from the project. Avoid exposing the vulnerable service to untrusted networks until a fix is released.