CVE-2026-109409
Received Received - Intake

Command Injection in Toonflow-app

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109409
EUVD
EUVD-2026-98696

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
HBAI-Ltd Toonflow-app 1.1.0
HBAI-Ltd Toonflow-app 1.1.1
HBAI-Ltd Toonflow-app 1.1.2
HBAI-Ltd Toonflow-app 1.1.3
HBAI-Ltd Toonflow-app 1.1.4
HBAI-Ltd Toonflow-app 1.1.5
HBAI-Ltd Toonflow-app 1.1.6
HBAI-Ltd Toonflow-app 1.1.7
HBAI-Ltd Toonflow-app 1.1.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in HBAI-Ltd Toonflow-app versions up to 1.1.8. It exists in the Open Folder Endpoint component, specifically in the file src/routes/setting/fileManagement/openFolder.ts. The issue occurs in the child_process.exec function where manipulating the 'path' argument can lead to arbitrary command execution. The attack requires local access to the system. A proof of concept exploit has been published. Upgrading to version 2.0.0 or later fixes the issue.

The vendor states the reported issue does not affect any supported release as the code paths mentioned are not present in current versions due to architectural changes.

Detection Guidance

Check if Toonflow-app version 1.1.8 or earlier is installed by inspecting the application version or file timestamps. Look for suspicious activity in logs related to the Open Folder Endpoint or child_process.exec usage. Monitor for unexpected command execution patterns.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to execute arbitrary commands on your system. This could lead to unauthorized data access, modification, or deletion, installation of malware, or further network compromise. The impact includes low confidentiality, integrity, and availability losses as per CVSS scoring.

Mitigation Strategies

Upgrade Toonflow-app to version 2.0.0 or later immediately. Remove or restrict access to vulnerable versions. Apply network segmentation to limit local attack vectors. Review and monitor systems for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart