Retour à la veille
CVE-2026-112263
Score CVSS
7.8
HIGH
Description détaillée
Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.
Vecteur d'attaque (CVSS)
Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Références et Patchs
https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.tomlhttps://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rshttps://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eechttps://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269https://github.com/alexpasmantier/television/issues/1166https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting
Dernières Vulnérabilités
CVE-2026-77228
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
VOIR DÉTAILS
CVE-2026-77227
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
VOIR DÉTAILS
CVE-2026-77225
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
VOIR DÉTAILS