CVE-2026-112263
CVE-2026-112263 · Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
CVSS 8.5 · High · EPSS 0.7%
- Published
- Updated
Affected products and versions
television
- Versions
- ≥ 0.15.0, ≤ 0.15.9: Affected (semver)
No fix published
Original sources
- https://github.com/alexpasmantier/television/issues/1166
- https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
- https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
- https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
- https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
- https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting
- https://nvd.nist.gov/vuln/detail/CVE-2026-112263