OS command injection in Television via external action formatting
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection flaw in format_command. Improperly escaped single quotes let an attacker run shell commands when a file with a crafted name containing an apostrophe is planted and a victim triggers an action such as the default edit action. The commands run with the victim's privileges, and no user interaction beyond triggering the action is needed by the attacker.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alexpasmantier | television | 0.15.0 – 0.15.9 | — | No fix listed | CNA |
- television Vendoralexpasmantier Affected 0.15.0 – 0.15.9 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Television.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-19 Threatist record created from CVE-2026-112263
- 2026-10-19 Alias added: GHSA-7x82-xp7c-mx7c
- 2026-10-21 Priority changed: MEDIUM → LOW
- 2026-10-22 CISA SSVC decision points changed
- 2026-10-22 Priority changed: LOW → MEDIUM
References
Patch 2
More alexpasmantier vulnerabilities
- TI-2026-76087 Command injection in alexpasmantier television output handling CVSS 4.0MEDIUM 4.8
Sources
- CVE-2026-112263 · CVE Program
- CVE-2026-112263 · NVD
- FIRST EPSS
- GHSA-7x82-xp7c-mx7c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences