CVE-2026-116046

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

CVE-2026-116046 eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

@eventcatalog/cli (>=0.1.0, <=1.1.0-beta.2), @eventcatalog/core (>=3.12.6-beta.2, <=5.0.0-beta.36) +10 more potentially affected by CVE-2026-116046 via @eventcatalog/sdk (>=2.2.7, <=2.30.0-beta.2)

@eventcatalog/sdk NPM version =2.2.7, =0.1.0, =3.12.6-beta.2, =0.1.1, =5.1.2, =7.7.1, =0.6.1, =1.0.1, =0.0.2, =1.0.0, =0.18.14, =0.6.14, =0.6.19 Source cves: CVE-2026-116046 Source advisory: MEND:CVE-2026-116046...

CVE-2026-116046 eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

CVE-2026-116046

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

EUVD-2026-109370

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

CVE-2026-116046

The eventcatalog sdk (up to version 2.29.0 ) is vulnerable to a path traversal flaw in the Custom Documentation Helpers component. Specifically, the functions getCustomDoc, writeCustomDoc, and rmCustomDoc within the file packages/sdk/src/custom-docs.ts fail to properly handle the options.path arg...

CVE-2026-116046 eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

PT-2026-122956

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

Malware in autotel-eventcatalog

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

MAL-2025-191452 Malicious code in @eventcatalog/generator-asyncapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9598dd9b72db501adb05bcad416fa140dc327848558cdcca03a10d2b127113b The package @eventcatalog/generator-asyncapi was found to contain malicious code. Source: ghsa-malware...

Malicious code in @eventcatalog/generator-asyncapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9598dd9b72db501adb05bcad416fa140dc327848558cdcca03a10d2b127113b The package @eventcatalog/generator-asyncapi was found to contain malicious code. Source: ghsa-malware...

Malware in @eventcatalog/generator-asyncapi

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

eventcatalog.ru XSS vulnerability

Open Bug Bounty ID: OBB-663555 Description| Value ---|--- Affected Website:| eventcatalog.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...