CVE-2026-112263
7.8HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78
Impact
Attackers can execute arbitrary shell commands with the victim's privileges by getting them to trigger an action on a maliciously named file. This requires local access or a shared filesystem to plant the crafted filename and user interaction to interact with it.
Root cause
Improper escaping of single quotes in format_command allows shell command injection when handling filenames containing apostrophes.
Affected systems
Television (tv) 0.15.0 through 0.15.9
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Television (tv) to a version newer than 0.15.9. As an interim workaround, avoid triggering external actions like the edit action on untrusted files or directory paths.
$ cargo install television --forceAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
References
- https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
- https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
- https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
- https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
- https://github.com/alexpasmantier/television/issues/1166
- https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting