Cpe:2.3:a:television:tv:0.15.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3atelevisiontv0.15.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 19 Oct 2026 16:08:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOS Command Injection in Television (tv) Packagehttps://feed.craftedsignal.io/briefs/2026-10-television-command-injection/Mon, 19 Oct 2026 16:08:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-television-command-injection/The Television (tv) package, versions 0.15.0 through 0.15.9, is vulnerable to OS command injection due to improper sanitization of single quotes within the format_command function.The Television (tv) package, versions 0.15.0 through 0.15.9, contains a critical OS command injection vulnerability. The flaw exists within the 'format_command' function, which fails to properly escape single quotes when processing input. An attacker can exploit this by planting or introducing a file with a maliciously crafted name containing an apostrophe into a directory monitored or processed by the application. When the application performs an action, such as the default 'edit' action on the crafted filename, the underlying shell interprets the apostrophe as a command separator or escape, leading to the execution of arbitrary shell commands with the privileges of the user running the application. This vulnerability presents a significant risk to development environments or servers utilizing the 'tv' package to manage file operations or editing workflows.

Impact

Successful exploitation allows for arbitrary code execution on the host machine with the privileges of the user running the Television package. This can lead to full system compromise, unauthorized data access, and further lateral movement within the network. The vulnerability affects users of the 'tv' package within the 0.15.x version range across all supported operating systems.

Recommendation

Prioritized actions for security teams:

  • Identify all instances of the 'tv' (Television) package within the environment via software composition analysis (SCA) or package manifest audits.
  • Upgrade the 'tv' package to a version beyond 0.15.9 immediately to remediate the 'format_command' vulnerability associated with CVE-2026-112263.
  • Implement file integrity monitoring on directories where the 'tv' package performs automated operations to detect the introduction of files with anomalous naming patterns.
]]>highadvisorycommand-injectionvulnerabilitysupply-chain