Threats affecting pkg:github/hbai-ltd/Toonflow-app

CVE-2026-109526 is an information disclosure vulnerability in HBAI-Ltd Toonflow-app versions 1.1.0 through 1.1.8. The flaw affects the exportData endpoint and requires local access to exploit. The vulnerability has been publicly disclosed but is mitigated by upgrading to version 2.0.0 or later, which features a substantial architectural refactor that removes the vulnerable code paths.

A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. The affected element is the function child_process.exec of the file src/routes/setting/fileManagement/openFolder.ts of the component Open Folder Endpoint. Executing a manipulation of the argument path can lead to command injection. The attack needs to be launched locally. The exploit has been published and may be used. Upgrading to version 2.0.0 is sufficient to fix this issue. You should upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release."

CVE-2026-7086 is a medium-severity path traversal vulnerability in HBAI-Ltd Toonflow-app versions up to 1.1.1. It affects the updateStoryboardUrl function in the Storyboard Export component, allowing remote manipulation of the url argument. The vendor states that the URL is intended to be a local or trusted domain address configured in Docker, and malicious links would only occur if the user modifies the code. The existence of the vulnerability is not fully confirmed, and no official patch or remediation guidance is currently available.

CVE-2026-7085 is a path traversal vulnerability in the Toonflow-app by HBAI-Ltd affecting versions up to 1.1.1. The issue exists in the downloadApp endpoint, specifically in the z.url function of src/routes/setting/about/downloadApp.ts, where manipulation of the url argument can lead to path traversal. The vulnerability can be triggered remotely but requires high attack complexity and is considered difficult to exploit. The vendor states that the update URL is statically compiled in the official code, limiting the risk unless users modify the code. The exploit has been publicly disclosed, but the actual existence of the vulnerability is questioned by the vendor. The CVSS 4.

CVE-2026-7084 is a server-side request forgery (SSRF) vulnerability in HBAI-Ltd Toonflow-app versions up to 1.1.1. It affects the fetch function in the getCodeByLink endpoint, allowing remote attackers to manipulate the Link argument to induce SSRF. The vendor notes that this interface is inherently high-risk and intended for users who understand the associated risks. There is some doubt about the actual existence of the vulnerability. The CVSS score is 5.3, indicating a medium severity level.