HBAI-Ltd CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM HBAI-Ltd CVE published 2026-10-13

CVE-2026-109409

A command injection vulnerability exists in HBAI-Ltd Toonflow-app versions up to 1.1.8. The issue is located in the Open Folder Endpoint, specifically in the openFolder.ts file, where user input is not properly sanitized, allowing an attacker to execute arbitrary commands. This vulnerability requires local access to exploit. The vulnerability affects the Open Folder Endpoint, a feature that allows users t [truncated]