---
id: CVE-2026-112263
title: >-
  Television 0.15.0 through 0.15.9 OS Command Injection via External Action
  Formatting
summary: >-
  Television (tv) 0.15.0 through 0.15.9 contains an OS command injection
  vulnerability that allows attackers to run shell commands through improperly
  escaped single quotes in format_command. Attackers can plant a file with a
  crafted name c…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: alexpasmantier
product: television
affected:
  - television >= 0.15.0 <= 0.15.9
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T13:55:13.736Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112263'
references:
  - url: 'https://github.com/alexpasmantier/television/issues/1166'
  - url: >-
      https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
  - url: >-
      https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
  - url: >-
      https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
  - url: >-
      https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
  - url: >-
      https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting
    label: >-
      VulnCheck Advisory: Television 0.15.0 through 0.15.9 OS Command Injection
      via External Action Formatting
tags:
  - cve.org
ingestedAt: '2026-10-19T14:30:01.075Z'
---

## Overview

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

## Affected

- `television >= 0.15.0 <= 0.15.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.