Live › vulnerability › CVE-2026-112263
Go to dashboardTelevision (tv), a terminal fuzzy finder, versions 0.15.0 through 0.15.9 fail to escape single quotes in format_command. A file with an apostrophe in its name can make a default action such as edit run attacker-chosen shell commands with the victim's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running Television 0.15.0 through 0.15.9 who browses directories that could contain files written by someone else, such as shared repositories, downloads folders or uploaded content. A user has to trigger an action on the crafted file for the command to run. Teams using other versions or only working in directories they control can skip it.
No product ranges from the sources yet.
tv --version and look for a version between 0.15.0 and 0.15.90.15.9 (the sources do not name the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-112263")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.