Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112263Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

High 7.8

In plain English

A high-severity OS command injection in television from alexpasmantier. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.7%top 48.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

Affected products (as reported)

Vendor	Product	Versions
alexpasmantier	television	0.15.0 – through 0.15.9

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/alexpasmantier/television/issues/1166 issue-tracking
https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269 patch
https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec patch
https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs technical-description
https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml technical-description
VulnCheck Advisory: Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting third-party-advisory