high7.8
CVE-2026-112263
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped sin…
Impact
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
Affected products
| Product | Affected versions |
|---|---|
| Television (Tv) 0.15.0 | through 0.15.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
- https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
- https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
- https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
- https://github.com/alexpasmantier/television/issues/1166
- https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting