CVE-2026-116046

The eventcatalog sdk (up to version 2.29.0 ) is vulnerable to a path traversal flaw in the Custom Documentation Helpers component. Specifically, the functions getCustomDoc, writeCustomDoc, and rmCustomDoc within the file packages/sdk/src/custom-docs.ts fail to properly handle the options.path arg...

CVE-2026-116046 eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

EUVD-2026-109370

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Malicious code in @eventcatalog/generator-asyncapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9598dd9b72db501adb05bcad416fa140dc327848558cdcca03a10d2b127113b The package @eventcatalog/generator-asyncapi was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191452 Malicious code in @eventcatalog/generator-asyncapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9598dd9b72db501adb05bcad416fa140dc327848558cdcca03a10d2b127113b The package @eventcatalog/generator-asyncapi was found to contain malicious code. Source: ghsa-malware...

eventcatalog.ru XSS vulnerability

Open Bug Bounty ID: OBB-663555 Description| Value ---|--- Affected Website:| eventcatalog.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...