Description
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Published: 2026-10-13
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local command execution
Action: Apply patch
AI Analysis

Impact

The flaw resides in the Open Folder endpoint of HBAI-Ltd Toonflow-app, where an untrusted argument is passed directly to child_process.exec in openFolder.ts. This oversight permits a crafted path value to inject arbitrary shell commands, leading to command injection as defined by CWE-74 and misuse of system command execution via CWE-77. An attacker with local access to the application can therefore execute arbitrary commands with the same privileges as the running process, potentially compromising the entire host.

Affected Systems

HBAI-Ltd Toonflow-app versions up to 1.1.8 are impacted. The issue was resolved in version 2.0.0, which implements a substantial architectural refactor eliminating the vulnerable code paths. All supported releases from 2.0.0 onward are free from this flaw.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate severity, and no EPSS data is available. The vulnerability is local, meaning an attacker must be able to interact with the application on the same machine. An exploit has already been published and may be used, but the lack of a KEV listing suggests it is not currently known as a widely exploited product. Overall, the risk is moderate but tangible if local attacker conditions exist.

Generated by OpenCVE AI on October 13, 2026 at 14:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Toonflow-app to version 2.0.0 or later to apply the vendor fix.
  • Restrict network access to the application so that only trusted hosts can reach the Open Folder endpoint, mitigating the local attack surface.
  • Sanitize all path inputs and consider replacing child_process.exec with a safer API or validation routine to prevent future command injection.
  • If the Open Folder feature is unnecessary, disable or remove the endpoint to reduce attack vectors.

Generated by OpenCVE AI on October 13, 2026 at 14:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Title HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection
First Time appeared Hbai-ltd
Hbai-ltd toonflow-app
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:hbai-ltd:toonflow-app:*:*:*:*:*:*:*:*
Vendors & Products Hbai-ltd
Hbai-ltd toonflow-app
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Hbai-ltd Toonflow-app
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T13:58:32.106Z

Reserved: 2026-10-12T14:57:43.204Z

Link: CVE-2026-109409

cve-icon Vulnrichment

Updated: 2026-10-13T13:58:26.365Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T14:17:25.673

Modified: 2026-10-13T19:26:24.643

Link: CVE-2026-109409

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T08:45:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')