{"id":"CVE-2026-111876","kind":"vulnerability","aliases":["CVE-2026-111876"],"related":[],"title":"television: crafted entry input causes command injection locally","description":"A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label \"not planned\".","summary":"Television, a terminal fuzzy finder, builds a shell command from entry data in Entry::output without safe handling. A local user who can supply crafted entry text can get extra commands run.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["local-users","package","television","terminal"],"not_affected_if":["newer-version","trusted-input-only"],"how_to_check":"- Check the installed version with `tv --version`; versions up to `0.15.9` are listed as affected.\n- Confirm whether the project's GitHub issue was closed as not planned, so no upstream fix is expected.","fix":null,"status":"open","published_at":"2026-10-18T06:16:57+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:26:47+00:00","updated_at":"2026-10-25T04:26:47+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:26:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"television: crafted entry input causes command injection locally","impact":"medium","summary":"Television, a terminal fuzzy finder, builds a shell command from entry data in Entry::output without safe handling. A local user who can supply crafted entry text can get extra commands run.","category":"package","nicknames":[],"who_cares":["television","terminal","local-users"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user runs commands through crafted entry input","analyst_note":"Confirm the exact trigger and whether any fixed version exists; the source gives only the NVD entry and the upstream issue was closed as not planned.","how_to_check":"- Check the installed version with `tv --version`; versions up to `0.15.9` are listed as affected.\n- Confirm whether the project's GitHub issue was closed as not planned, so no upstream fix is expected.","needs_analyst":true,"not_affected_if":["newer-version","trusted-input-only"],"who_is_affected":"Only people running television `0.15.9` or earlier on a machine where untrusted data can reach its entry lists. The source describes a local attack and the upstream issue was closed as not planned, so no patch is confirmed. Teams that only use television with their own trusted lists are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000573,"input_tokens":3310,"output_tokens":484,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111876':11A,14A '-2026':10A,13A '0.15.9':62C 'affect':63C 'alexpasmanti':58C 'approach':92C 'argument':81C 'attack':88C 'build':26B 'caus':5A 'close':98C 'command':6A,29B,51B,85C 'craft':2A,45B 'cve':9A,12A 'data':32B 'entri':3A,31B,34B,46B,70C 'extra':50B 'file':74C 'finder':25B 'found':56C 'function':69C 'fuzzi':24B 'get':49B 'github':95C 'handl':38B 'inject':7A,86C 'input':4A 'issu':66C,96C 'label':101C 'local':8A,16B,40B,91C 'local-us':15B 'manipul':78C 'output':35B,71C 'packag':18B 'perform':76C 'plan':103C 'raw':82C 'report':94C 'requir':89C 'result':83C 'run':52B 'safe':37B 'shell':28B 'suppli':44B 'televis':1A,19B,21B,59C 'television/channels/entry.rs':75C 'termin':20B,23B 'text':47B 'user':17B,41B 'vulner':54C 'without':36B","nicknames":[],"mitigations":[],"who_affected":"Only people running television `0.15.9` or earlier on a machine where untrusted data can reach its entry lists. The source describes a local attack and the upstream issue was closed as not planned, so no patch is confirmed. Teams that only use television with their own trusted lists are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T06:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111876","severity":null,"published_at":"2026-10-18T06:16:57+00:00","modified_at":"2026-10-19T20:17:52+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}