CVE-2026-112263
Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
alexpasmantier television
CVSS
8.5HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.66%Chance of exploitation activity in the next 30 days, higher than 50% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
Text from CVE List
Affected versions 1
- televisionaffected: 0.15.0 through 0.15.9CVE List
References 6
- github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269Fixvia CVE List
- github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eecFixvia CVE List
- vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formattingAdvisoryvia CVE List
- github.com/alexpasmantier/television/issues/1166Referencevia CVE List
- github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rsReferencevia CVE List
- github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.tomlReferencevia CVE List