CVE-2026-112263
CVE-2026-112263 · Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
CVSS 8.5 · Hoch · EPSS 0,7%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
television
- Softwareversionen
- ≥ 0.15.0, ≤ 0.15.9: Betroffen (semver)
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/alexpasmantier/television/issues/1166
- https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
- https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
- https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
- https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
- https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting
- https://nvd.nist.gov/vuln/detail/CVE-2026-112263