Threat database

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

CVE-2026-111876 is a command injection vulnerability in the alexpasmantier television software up to version 0.15.9. The flaw exists in the Entry::output function within the television/channels/entry.rs file. Exploitation requires local access and involves manipulating the 'raw' argument to execute arbitrary commands. The issue was reported but the related GitHub issue was closed as 'not planned' for a fix. The vulnerability has a medium severity with a CVSS 4.8 score.