CVE-2026-109409
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Risk Assessment
Local attack can lead to arbitrary command execution on the system, potentially resulting in full control of the application or system.
Recommendation
Upgrade Toonflow-app to version 2.0.0 or later. Restrict local access to the application.
Other vulnerabilities in Toonflow-app
See all- CVE-2026-109526Low
In HBAI-Ltd Toonflow-app up to 1.1.8, an unknown function of the exportData Endpoint component leads to information disclosure. The attack requires local access, and the exploit has been disclosed to the public. Upgrading to version 2.0.0 mitigates this issue. The vendor explains that the report targets version 1.1.8, while the current release 2.0.4 is the result of a substantial architectural refactor and the referenced code paths do not apply.
- CVE-2026-7086Medium
A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1 affecting the updateStoryboardUrl function in replaceUrl.ts of the Storyboard Export component; manipulation of the url argument leads to path traversal. The attack can be launched remotely and a public exploit may be used. The vendor states the URL is designed to be local or trusted unless the user modifies the code.
- CVE-2026-7085Medium
A vulnerability was determined in HBAI-Ltd Toonflow-app up to 1.1.1 in the z.url function of src/routes/setting/about/downloadApp.ts (downloadApp Endpoint), where manipulation of the url argument causes path traversal. The attack can be initiated remotely, is considered high complexity, and the exploit has been publicly disclosed. The real existence of this vulnerability is still doubted, and the vendor states the update URL is statically compiled in the official repository.
- CVE-2026-7084Medium
A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. It affects the fetch function of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the getCodeByLink Endpoint component. Manipulation of the Link argument results in server-side request forgery. There is ongoing doubt regarding the real existence of this vulnerability.
Original NVD description (English source)
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Vulnerability data from NVD (NIST) · CISA KEV · EPSS