Skip to content
OpenAdvisories

Package · npm

neotoma

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low —
    GHSA-wrr4-782v-jhwh

    neotoma has tenant isolation gap in relationship query endpoints

    ## Summary The `/list_relationships` and `/retrieve_graph_neighborhood` endpoints call `getAuthenticatedUserId` (confirming a valid session exists) but do not pass the resolved user ID into the Supabase query as an `.eq("user_id", userId)` filter. As a result…

    neotoma npm