television CVE-2026-111876

Requires that an attacker control the name/output of an entry (e.g., a file in a directory the victim navigates) that contains terminal control or escape characters, and that the victim run television ≤0.15.9 and select that entry; the raw Entry::output value is then written to the real terminal after the TUI exits, bypassing ratatui's protective rendering. Limiting factors: local access is needed to stage the malicious entry (AV:L, PR:L), the victim must interactively select it, the victim's terminal emulator must interpret the injected escape sequences for any impact, and versions above 0.15.9 (with sanitize_for_display from PR #1125) are not affected.

This is a low-priority, high-noise issue rather than a genuine emergency. The CVSS 4.0 base score is 4.8 (Medium) with a local attack vector (AV:L), low attack complexity (AC:L), and low privileges required (PR:L), and the vulnerable/subsequent impacts are all Low or None (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N) - so even under CVSS this is not a high-severity flaw. The vector carries E:P (Proof-of-Concept) exploit maturity, which indicates at most a conceptual exploit, not weaponization; the input provides no explicit POC=YES flag and no KEV listing, so this is best described as no public exploit identified at time of analysis. No EPSS score and no SSVC decision were provided, so widespread-exploitation probability cannot be quantified from the data. Most importantly, the signals conflict with the labeling: the CWE-77 'command injection' classification and the 'Command Injection' tag (both originating from VulDB) are not supported by the vendor fix, which is a sanitize_for_display() routine that replaces terminal control/escape characters - i.e., this is terminal escape-sequence injection into the real terminal after the TUI exits, not OS command execution. The vendor itself initially closed the GitHub issue as 'not planned' before merging a defensive fix (PR #1125), consistent with a low real-world risk judgment. Local vector plus niche deployment plus mislabeled impact class means this should be treated as a hygiene/display-integrity fix, not an urgent remotely-exploitable RCE.

An attacker who can place a file (or otherwise influence an entry's output) in a directory a victim browses crafts a name containing terminal escape sequences; because television ≤0.15.9 prints the selected entry's raw output to the real terminal after the TUI exits - bypassing ratatui's protective rendering - the sequences are interpreted by the victim's terminal emulator. Given AV:L and PR:L, this requires local positioning and the victim selecting the malicious entry; a proof-of-concept is suggested by the E:P exploit-maturity flag but no weaponized or publicly confirmed exploit was provided in the input.