CVE-2026-112263

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112263
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112263.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112263
Published
2026-10-19T13:55:13Z
Modified
2026-10-21T02:55:51Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting
Details

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112263.json"
}
References

Affected packages

Git / github.com/alexpasmantier/television

Affected ranges

Type
GIT
Repo
https://github.com/alexpasmantier/television
Events
Introduced
e1caf27b8ced7643150129d8224a9f26b5c1694b
Last Affected
b17cdfaa43c7e1300d52d2660fc9793a1fda7e21
Fixed
d7d46abb791181a3b5b6eed05e72aafcaa0ef269
Fixed
32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.15.0"
                },
                {
                    "last_affected":  "0.15.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "d7d46abb791181a3b5b6eed05e72aafcaa0ef269"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "32695ccc6cd2b05cf7f1d3b80c24e324d5343eec"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.15.5
0.15.6
0.15.7
0.15.8
0.15.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112263.json"