CVE-2026-112263

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

CVSS 4.0

8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-25)

CWE

CWE-78

Published

2026-10-19

Modified

2026-10-22

Record from

the NVD, synced 2026-10-22

References

• https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
• https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
• https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
• https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
• https://github.com/alexpasmantier/television/issues/1166

Check your stackJSON