CVE-2026-112263

HighCVSS 7.8

Published: 19/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.66%

51th percentile - higher than 51% of all known CVEs

Summary

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability allowing attackers to run shell commands through improperly escaped single quotes in format_command. A file with a crafted name containing an apostrophe can cause an action like the default edit action to execute commands with victim privileges.

Risk Assessment

An attacker could execute arbitrary commands with the privileges of the user running tv, potentially leading to system compromise. Users browsing untrusted files are at risk.

Recommendation

Update Television to a version containing the fix or avoid opening untrusted files. Also verify single quote escaping in format_command.

Other vulnerabilities in Television

CVE-2026-111876Medium
The television application (up to version 0.15.9) has a Command Injection vulnerability in the Entry::output function of the television/channels/entry.rs file due to manipulation of the raw argument. The attack requires local access.

Original NVD description (English source)

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS