Television
Monthly
OS command injection in television (tv) 0.15.0 through 0.15.9 lets an attacker who can plant a file whose name contains an apostrophe execute arbitrary shell commands with the victim's privileges once that entry is selected and an action is triggered - most notably the bundled default edit action. The vulnerability is local and requires victim interaction (CVSS 4.0 8.5; independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R with high confidentiality, integrity and availability impact on the victim's account), and no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Upstream fix commits addressing the quoting logic have been published by the vendor.
Terminal escape sequence injection in alexpasmantier television through 0.15.9 allows a local attacker who controls an entry's output, such as a crafted filename, to write unsanitized control characters to the victim's terminal after the TUI exits, provided the victim selects that entry. The CVE is tracked as CWE-77 command injection and rated CVSS 4.8, but PR #1125 adds sanitize_for_display for control characters, indicating the practical issue is terminal escape/control-character injection rather than direct command execution. The CVSS vector notes E:P (Proof-of-Concept exploit maturity), but no CISA KEV active exploitation is confirmed; exploitation requires local staging and victim interaction, making this a low-priority issue.
OS command injection in television (tv) 0.15.0 through 0.15.9 lets an attacker who can plant a file whose name contains an apostrophe execute arbitrary shell commands with the victim's privileges once that entry is selected and an action is triggered - most notably the bundled default edit action. The vulnerability is local and requires victim interaction (CVSS 4.0 8.5; independently assessed as CVSS 3.1 AV:L/AC:L/PR:N/UI:R with high confidentiality, integrity and availability impact on the victim's account), and no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Upstream fix commits addressing the quoting logic have been published by the vendor.
Terminal escape sequence injection in alexpasmantier television through 0.15.9 allows a local attacker who controls an entry's output, such as a crafted filename, to write unsanitized control characters to the victim's terminal after the TUI exits, provided the victim selects that entry. The CVE is tracked as CWE-77 command injection and rated CVSS 4.8, but PR #1125 adds sanitize_for_display for control characters, indicating the practical issue is terminal escape/control-character injection rather than direct command execution. The CVSS vector notes E:P (Proof-of-Concept exploit maturity), but no CISA KEV active exploitation is confirmed; exploitation requires local staging and victim interaction, making this a low-priority issue.