Product
The Television (tv) package, versions 0.15.0 through 0.15.9, is vulnerable to OS command injection due to improper sanitization of single quotes within the format_command function.