CVE-2026-7084

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-7084

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7084.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-7084

Published

2026-04-27T03:45:11.797Z

Modified

2026-07-15T01:49:12.492083635Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

HBAI-Ltd Toonflow-app getCodeByLink Endpoint getCodeByLink.ts fetch server-side request forgery

Details

A vulnerability was found in HBAI-Ltd Toonflow-app up to 1.1.1. This affects the function fetch of the file src/routes/setting/vendorConfig/getCodeByLink.ts of the component getCodeByLink Endpoint. The manipulation of the argument Link results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. There is ongoing doubt regarding the real existence of this vulnerability. The vendor explains in a reply to the issue report, that "[t]he /getCodeByLink interface is used to obtain TS code and run it locally. It is inherently a high-risk interface, and users must clearly understand the risks before requesting to use it."

Database specific

{
    "cwe_ids": [
        "CWE-918"
    ],
    "isDisputed": true,
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7084.json"
}

References

Affected packages

Git / github.com/hbai-ltd/toonflow-app

Affected ranges

Type

GIT

Repo

https://github.com/hbai-ltd/toonflow-app

Events

Introduced

48261eea10fe33499a504d2ecbaf05562b1a3492

Last affected

cbde256277b4005748d9b44ba1eab2b7d289b39d

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0"
        },
        {
            "introduced": "1.1.1"
        },
        {
            "last_affected": "1.1.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.1.0

1.1.1

v1.*

v1.1.0

v1.1.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7084.json"