Path Traversal Vulnerability in notebooklm-mcp

A path traversal vulnerability exists in the @roomi-fields/notebooklm-mcp package, affecting versions 1.6.0 through 2.0.2. The vulnerability stems from improper sanitization of the vault_dir and slug_prefix parameters within the vault.batch MCP tool and the corresponding /batch-to-vault HTTP endpoint. The application directly utilizes these parameters in file system operations using path.resolve() and fs.mkdir() without enforcing boundary checks. An attacker or a compromised LLM driving the MCP interface can supply crafted path inputs containing directory traversal sequences (e.g., ..) or absolute paths to write markdown and JSON files into sensitive directories on the host filesystem that the server process has permissions to access.

Impact

Successful exploitation allows an attacker to write files anywhere the server process has write access. While the files are inert content (markdown/JSON), this vulnerability poses a significant risk in multi-user environments or when the MCP server is integrated with LLMs that ingest untrusted user content (e.g., via prompt injection). Attackers could potentially plant files in autostart folders or shell configuration files, leading to downstream command execution or system persistence.

Recommendation

1. Upgrade @roomi-fields/notebooklm-mcp to version 2.0.3 or later immediately.
2. Following the upgrade, enforce directory containment by configuring the NOTEBOOKLM_VAULT_ROOT environment variable to a restricted directory path.
3. If immediate patching is not possible, restrict the exposure of the HTTP /batch-to-vault endpoint to local loopback interfaces only.
4. Ensure the service runs under a dedicated, unprivileged service account with write permissions restricted strictly to the intended vault location.