CVE-2026-112263: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in alexpasmantier television

The vulnerability in alexpasmantier television (versions 0.15.0 through 0.15.9) stems from improper neutralization of special elements used in OS commands, specifically in the format_command function. This improper escaping of single quotes allows an attacker to inject shell commands by planting a file with a specially crafted name containing an apostrophe. Triggering certain actions, such as the default edit action, causes execution of these injected commands with the privileges of the victim user.

Successful exploitation enables an attacker to execute arbitrary shell commands on the victim system with the privileges of the user running the television application. This can lead to unauthorized actions, data compromise, or system manipulation. The CVSS 4.0 score of 8.5 indicates a high severity impact, with low attack complexity but requiring user interaction.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid opening or triggering actions on files with suspicious names containing special characters such as apostrophes. Monitor vendor channels for updates and apply patches promptly once released.