This vulnerability in the NotebookLM MCP server allows an attacker to craft input to the POST /batch-to-vault endpoint or the batch_to_vault MCP tool such that the supplied vault_dir and slug_prefix fields are not properly sanitized. By exploiting the path traversal logic, the server can write Markdown and JSON files to any location writable by the process, effectively enabling arbitrary file creation or modification outside the intended vault directory.

The affected product is the roomi-fields notebooklm-mcp server. Versions 1.6.0 through 2.0.2, inclusive, are susceptible. Version 1.7.0 introduced the batch_to_vault tool but remains vulnerable. The vulnerability is fixed starting with version 2.0.3, which sanitizes slug_prefix and enables vault containment when the NOTEBOOKLM_VAULT_ROOT environment variable is set. Clients unable to upgrade should confine the server process to a dedicated unprivileged account and enforce local‑only access.

The CVSS score of 7.1 classifies this issue as high severity. While an EPSS score is not available, the lack of KEV listing and the fact that the vulnerability requires crafted HTTP requests or tool usage suggest a moderate exploitation probability in realistic settings. If the HTTP service is exposed to untrusted users, an attacker could write arbitrary files, including potentially executable code, thereby achieving privilege escalation or data exfiltration. Limiting network exposure, running a non‑privileged account, and validating supplied paths are essential mitigations against this attack.