CVE-2026-109409: HBAI-Ltd Toonflow-app Open Folder Endpoint openFolder.ts child_process.exec command injection
A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function childprocess.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HBAI-Ltd Toonflow-appto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Exposure is limited to local attackers with existing low-level privileges, because the attack vector is local and privileges are required. Versions up to 1.1.8 are identified as affected; the vendor states that supported releases do not contain the referenced code path.
What must an attacker control to exploit the vulnerability?
An attacker needs to manipulate the path argument processed by the Open Folder Endpoint. That input reaches child_process.exec in src/routes/setting/fileManagement/openFolder.ts, allowing command injection.
What should teams do if they are running an affected version?
Upgrade Toonflow-app to version 2.0.0 or later. The vendor says the current 2.0.4 release resulted from an architectural refactor and the reported code paths do not apply to it.
Is exploit code available?
Yes. The available information states that an exploit has been published and may be used.