HIGH 8.5 NVD
CVE-2026-112263
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped sing
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
References
- https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
- https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
- https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343e
- https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef2
- https://github.com/alexpasmantier/television/issues/1166
This high severity vulnerability with a CVSS score of 8.5 was published on 2026-10-19 via NVD.
vulnfeed aggregates 17437 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.