CVE-2026-61647: NotebookLM MCP writes exported files outside the vault via batch_to_vault
NVD·medium signal
Published 2026-09-21 at CVSS 7.1 high. NotebookLM MCP versions 1.6.0 through 2.0.2 contain a path traversal in the POST /batch-to-vault endpoint, also exposed as the batch_to_vault MCP tool from 1.7.0, where attacker-controlled vault_dir and slug_prefix values cause Markdown and JSON files to be written anywhere on disk. An export tool that takes a destination path from the caller is a write primitive, and this one is reachable over HTTP as well as through the agent.