Skip to content
OpenAdvisories

Package · npm

neotoma

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low —
    GHSA-wrr4-782v-jhwh

    neotoma has tenant isolation gap in relationship query endpoints

    ## Summary The `/list_relationships` and `/retrieve_graph_neighborhood` endpoints call `getAuthenticatedUserId` (confirming a valid session exists) but do not pass the resolved user ID into the Supabase query as an `.eq("user_id", userId)` filter. As a result…

    neotoma npm
  • Medium 6.9
    CVE-2026-45577

    Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass

    Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployment…

    markmhendrickson neotoma neotoma npm