CVE-2026-109409 | HBAI-Ltd Toonflow-app up to 1.1.8 Open Folder Endpoint openFolder.ts child_process.exec path command injection

October 12, 2026 Yanac

A vulnerability, which was classified as problematic, was found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection.

This vulnerability is registered as CVE-2026-109409. The attack needs to be launched locally. Furthermore, an exploit is available.

You should upgrade the affected component.

The vendor explains: “The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release.”VulDB Recent EntriesRead More