CVE-2026-112263
CVE-2026-112263 · Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
CVSS 8.5 · Alta · EPSS 0,7%
- Publicación
- Actualización
Productos y versiones afectados
television
- Versiones
- ≥ 0.15.0, ≤ 0.15.9: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/alexpasmantier/television/issues/1166
- https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
- https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
- https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
- https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
- https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting
- https://nvd.nist.gov/vuln/detail/CVE-2026-112263