CVE-2026-111876

MediumCVSS 5.3

Published: 18/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.62%

49th percentile - higher than 49% of all known CVEs

Summary

The television application (up to version 0.15.9) has a Command Injection vulnerability in the Entry::output function of the television/channels/entry.rs file due to manipulation of the raw argument. The attack requires local access.

Risk Assessment

An attacker with local access can execute arbitrary commands on the system, potentially leading to privilege escalation or full system compromise. The issue was closed as "not planned", so a fix may not be released.

Recommendation

It is recommended to discontinue use of this application or self-fix the vulnerability by validating input. Monitor the project repository for future updates.

Other vulnerabilities in television

CVE-2026-112263High
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability allowing attackers to run shell commands through improperly escaped single quotes in format_command. A file with a crafted name containing an apostrophe can cause an action like the default edit action to execute commands with victim privileges.

Original NVD description (English source)

A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label "not planned".

Vulnerability data from NVD (NIST) · CISA KEV · EPSS