Television (tv): OS command injection via crafted file names
Summary
Television (tv) versions 0.15.0 through 0.15.9 contain an OS command injection flaw in format_command, where single quotes in file names are not escaped correctly. An attacker who can place a file with a crafted name containing an apostrophe in a location the user works in can run shell commands with the victim's privileges once the user triggers an action such as the default edit action. Exploitation requires local file access and user interaction, but no network access or authentication.
Affected
- Television (tv) 0.15.0 through 0.15.9
Fixed in
Unknown. Do not assume that 0.15.9 or later is fixed until the upstream commit 32695ccc6cd2b05cf7f1d3b80c24e324d5343eec and the release notes have been checked.
Workaround
No vendor workaround documented.
- Until a fixed version is confirmed, do not run tv in untrusted repositories, downloaded archives or shared folders.
- Avoid edit and external-action keybindings on files whose names you did not create.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in the CISA KEV catalog. EPSS below 1%.
- Public proof of concept: unverified.
- No known exploitation in the wild.
Our recommendation
- Inventory where tv is installed (for example Homebrew, Cargo, WinGet or Nix).
- Restrict use of tv on untrusted code, downloads and shared drives until a fix is confirmed.
- Track the upstream fix and update to a release confirmed to contain it.
- Monitor the upstream issue and advisories.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-112263 VulnCheck advisory www.vulncheck.com
- Television commit 32695ccc (possible fix) github.com
- Television commit d7d46abb github.com
- Television issue 1166 github.com
- Television 0.15.9 command.rs github.com
- Television 0.15.9 files.toml github.com
- OpenCVE CVE-2026-112263 app.opencve.io
- Television project repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:25.
Original description (NVD)
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
NVD references (6)
- https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml
- https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs
- https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec
- https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269
- https://github.com/alexpasmantier/television/issues/1166
- https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-actio…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.