CVE-2026-111876
Received Received - Intake

Command Injection in Television Application

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label "not planned".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-111876
EUVD
EUVD-2026-103387

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
alexpasmantier television 0.15.0
alexpasmantier television 0.15.1
alexpasmantier television 0.15.2
alexpasmantier television 0.15.3
alexpasmantier television 0.15.4
alexpasmantier television 0.15.5
alexpasmantier television 0.15.6
alexpasmantier television 0.15.7
alexpasmantier television 0.15.8
alexpasmantier television 0.15.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in the television tool up to version 0.15.9. It exists in the Entry::output function of the file television/channels/entry.rs. The issue allows manipulation of the raw argument to execute arbitrary commands. The attack requires local access and was closed by the maintainer as not planned.

Detection Guidance

This vulnerability involves command injection via the raw argument in the Entry::output function when printing selected entries after exiting the TUI. To detect it, inspect files or commands that use television for file selection, especially those that pass raw output to shell commands. Check for files with crafted names containing terminal escape sequences.

Impact Analysis

An attacker with local access could craft malicious file names containing terminal escape sequences. When selected in television, these sequences are printed directly to the terminal after exiting the TUI, potentially leading to arbitrary code execution or other malicious actions depending on the terminal emulator.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling arbitrary code execution through command injection. If exploited, it may lead to unauthorized data access, modification, or exfiltration, violating confidentiality and integrity requirements of these regulations.

Mitigation Strategies

Immediately update television to the latest version if a patch is available. Avoid using television to select files for direct shell command execution. Sanitize file names before passing them to shell commands. Monitor terminal output for unexpected escape sequences.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111876. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart