CVE-2026-112263: Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Q: Who is exposed to this issue?

Users of Television 0.15.0 through 0.15.9 are exposed when they browse or otherwise select attacker-controlled filenames and trigger an external action that formats the selected path into a shell command. The command runs with the privileges of the user running Television.

Q: What does an attacker need to do to exploit it?

The attacker needs to make a file with a crafted name containing an apostrophe available to the victim. The victim must then trigger an affected external action, such as the default edit action, for command execution to occur.

Q: Are default settings affected?

Yes. The described attack can use the default edit action, so exploitation does not necessarily require a custom external-action configuration.

Q: How can I tell whether I am affected?

Check whether Television is version 0.15.0 through 0.15.9 and whether users can select files from locations where untrusted parties can create filenames. Risk is present if external actions such as edit can be triggered on those filenames.

Published Oct 19, 2026

Updated

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in formatcommand. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

Affected Software

1 affected component

Television>=0.15.0<=0.15.9

Event History

Oct 19, 2026

CVE Published

via MITRE·01:55 PM

Data Sourced

via MITRE·01:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of Television 0.15.0 through 0.15.9 are exposed when they browse or otherwise select attacker-controlled filenames and trigger an external action that formats the selected path into a shell command. The command runs with the privileges of the user running Television.

What does an attacker need to do to exploit it?

The attacker needs to make a file with a crafted name containing an apostrophe available to the victim. The victim must then trigger an affected external action, such as the default edit action, for command execution to occur.

Are default settings affected?

Yes. The described attack can use the default edit action, so exploitation does not necessarily require a custom external-action configuration.

How can I tell whether I am affected?

Check whether Television is version 0.15.0 through 0.15.9 and whether users can select files from locations where untrusted parties can create filenames. Risk is present if external actions such as edit can be triggered on those filenames.

CVE-2026-112263: Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Are default settings affected?

How can I tell whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Are default settings affected?

How can I tell whether I am affected?