CVE WatchOct 13, 2026

CVE-2026-109409

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/s

CVSS

5.3

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Oct 13, 2026 · Last modified: Oct 13, 2026 · CWE-74 · CWE-77

EPSS · 30d

Not enough EPSS history yet.

Technical description

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-977818.8 HIG

—

——0Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.12h CVE-2026-969518.8 HIG

—

KEV—50Microsoft Windows Command Injection Vulnerability12h CVE-2026-880948.1 HIG

—

——0Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.11h CVE-2026-697187.8 HIG

—

——0Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.10h CVE-2026-693708.8 HIG

—

——0Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.9h CVE-2026-1096207.3 HIG

—

——0A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.12h