Live › vulnerability › CVE-2026-111876
Go to dashboardTelevision, a terminal fuzzy finder, builds a shell command from entry data in Entry::output without safe handling. A local user who can supply crafted entry text can get extra commands run.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only people running television or earlier on a machine where untrusted data can reach its entry lists. The source describes a local attack and the upstream issue was closed as not planned, so no patch is confirmed. Teams that only use television with their own trusted lists are unlikely to be exposed.
0.15.9No product ranges from the sources yet.
tv --version; versions up to 0.15.9 are listed as affected.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label "not planned".
This page as .md · .json · in your agent: get_signal("CVE-2026-111876")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.