What happened
Published 2026-09-21 (GHSA-jjhp-8crj-mppq). The HTTP endpoint and the MCP tool both feed attacker-influenced path values into a file-write operation without containment when NOTEBOOKLM_VAULT_ROOT is unset.
Why it matters
Confirms the recurring pattern of MCP servers trusting LLM-controlled parameters in filesystem operations: a retrieved document or tool output can steer an agent into writing files outside its intended data vault (potential config/persistence tampering).
Attack vector
Attacker-controlled vault_dir and slug_prefix values in POST /batch-to-vault (exposed as the batch_to_vault MCP tool from 1.7.0) permit Markdown/JSON files to be written outside the intended vault directory to any location writable by the server process.
Affected systems
roomi-fields/notebooklm-mcp >= 1.6.0, < 2.0.3
Mitigation
Upgrade to 2.0.3 (sanitises slug_prefix; vault containment when NOTEBOOKLM_VAULT_ROOT is set). Workarounds: run as a dedicated unprivileged user restricted to the vault, bind HTTP to localhost, and validate vault_dir values supplied by LLMs.