CVE-2026-109409 Details
Description
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
A command injection vulnerability has been identified in HBAI-Ltd Toonflow-app versions prior to 1.1.8. The issue arises in the Open Folder Endpoint, specifically within the child_process.exec function of openFolder.ts. The vulnerability can be exploited locally by manipulating the argument path. Although the exploit has been published and is available for use, upgrading to version 2.0.0 effectively resolves the issue. The vendor states that the reported vulnerability does not apply to any supported release.
Users are advised to upgrade to HBAI-Ltd Toonflow-app version 2.0.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://drive.google.com/drive/folders/19JuQt4385UFpRyLXglv80V0uxZujxUE9?usp=drive_link | [email protected] | BundleExploitPartial Content |
| https://github.com/HBAI-Ltd/Toonflow-app/releases/tag/v2.0.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-109409 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/982704 | [email protected] | Permission Required |
| https://vuldb.com/vuln/416951 | [email protected] | Permission Required |
| https://vuldb.com/vuln/416951/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HBAI-Ltd Toonflow-app | <= 1.1.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | New CVE Received | [email protected] |
| Oct 13, 2026 | CVE Modified | CISA-ADP |