CVE-2026-112263

EUVD-2026-104310
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 50.78%
Common Weakness Enumeration
References
https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
https://github.com/alexpasmantier/television/issues/1166
https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting