Insertion of Sensitive Information Into Sent Data Affecting neotoma package, versions >=0.13.0 <0.14.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-NEOTOMA-17818127
- published5 Jul 2026
- disclosed25 Jun 2026
- creditUnknown
Introduced: 25 Jun 2026
New CVE NOT AVAILABLE CWE-201 (opens in a new tab)How to fix?
Upgrade neotoma to version 0.14.0 or higher.
Overview
neotoma is a MCP server for structured personal data memory with unified source ingestion
Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the /list_relationships and /retrieve_graph_neighborhood endpoints due to missing user ID filtering in Supabase queries. An attacker can access relationship and graph neighborhood data belonging to other users by providing a valid authentication token and a known entity ID associated with another user. This is only exploitable if the attacker has a legitimate account on the same instance and knows a valid entity ID belonging to another user.