{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atelevisiontv0.15.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:television:tv:0.15.0:*:*:*:*:*:*:*","cpe:2.3:a:television:tv:0.15.9:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-112263"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Television (0.15.0 - 0.15.9)"],"_cs_severities":["high"],"_cs_tags":["command-injection","vulnerability","supply-chain"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Television (tv) package, versions 0.15.0 through 0.15.9, contains a critical OS command injection vulnerability. The flaw exists within the 'format_command' function, which fails to properly escape single quotes when processing input. An attacker can exploit this by planting or introducing a file with a maliciously crafted name containing an apostrophe into a directory monitored or processed by the application. When the application performs an action, such as the default 'edit' action on the crafted filename, the underlying shell interprets the apostrophe as a command separator or escape, leading to the execution of arbitrary shell commands with the privileges of the user running the application. This vulnerability presents a significant risk to development environments or servers utilizing the 'tv' package to manage file operations or editing workflows.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution on the host machine with the privileges of the user running the Television package. This can lead to full system compromise, unauthorized data access, and further lateral movement within the network. The vulnerability affects users of the 'tv' package within the 0.15.x version range across all supported operating systems.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of the 'tv' (Television) package within the environment via software composition analysis (SCA) or package manifest audits.\u003c/li\u003e\n\u003cli\u003eUpgrade the 'tv' package to a version beyond 0.15.9 immediately to remediate the 'format_command' vulnerability associated with CVE-2026-112263.\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring on directories where the 'tv' package performs automated operations to detect the introduction of files with anomalous naming patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T16:08:24Z","date_published":"2026-10-19T16:08:24Z","id":"https://feed.craftedsignal.io/briefs/2026-10-television-command-injection/","summary":"The Television (tv) package, versions 0.15.0 through 0.15.9, is vulnerable to OS command injection due to improper sanitization of single quotes within the format_command function.","title":"OS Command Injection in Television (tv) Package","url":"https://feed.craftedsignal.io/briefs/2026-10-television-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:television:tv:0.15.9:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}