Television CVE-2026-112263

Exploitation requires that the attacker can place a file with a maliciously crafted name (containing an apostrophe / single quote) somewhere the victim will enumerate with television, AND that the victim then triggers an action that passes entries through format_command - notably the bundled default edit action (template "${EDITOR:-vim} {}" from cable/unix/files.toml). Limiting factors: the attack is LOCAL (the crafted filename must reach the victim's filesystem, e.g. via a shared folder, downloaded archive, or cloned repo), it requires victim user interaction (selecting the entry and invoking the action - the attacker cannot fire it remotely), and it only affects television versions 0.15.0 through 0.15.9. Commands execute with the victim user's privileges, not elevated.

This is a genuine but access-constrained vulnerability rather than a mass-exploitation priority. The authoritative CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) scores 8.5 and is internally consistent with the description: the attack vector is LOCAL, not network, and requires passive user interaction (the victim triggering an action such as the default edit action on an attacker-named file). High VC:H/VI:H/VA:H reflects full command execution with the victim's privileges. Exploitation status is 'publicly available exploit code exists' - a working PoC is committed in the fix (tests/poc_command_injection.rs) and VulnCheck published an advisory - but this is NOT confirmed active exploitation: the CVE is not listed in CISA KEV and no EPSS probability was provided in the input. These signals are consistent (no conflict): a local, user-interaction-dependent flaw in a developer CLI tool with a public PoC but no KEV listing points to a real-but-contained issue, not widespread automated exploitation. The key missing data is EPSS score and any real-world exploitation telemetry; absent those, treat this as an important patch-soon issue for affected users rather than an emergency.

An attacker crafts a file whose name embeds a shell payload inside an apostrophe (e.g. "x'; printf INJECTED; #'") and places it where the victim will browse it - a shared directory, an extracted archive, or a cloned repository. When the victim opens television (tv), navigates to that entry, and triggers an action such as the default edit action, the malformed single-quote escaping in format_command lets the payload break out and run as a separate shell command with the victim's privileges. A functional PoC demonstrating this breakout exists in the vendor's fix commit.