Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-112263 (GCVE-0-2026-112263)

Vulnerability from nvd – Published: 2026-10-19 13:55 – Updated: 2026-10-19 13:55

Title

Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Summary

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6503 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/alexpasmantier/television/issu…	issue-tracking
https://github.com/alexpasmantier/television/comm…	patch
https://github.com/alexpasmantier/television/comm…	patch
https://github.com/alexpasmantier/television/blob…	technical-description
https://github.com/alexpasmantier/television/blob…	technical-description
https://www.vulncheck.com/advisories/television-0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
alexpasmantier	television	Affected: 0.15.0 , ≤ 0.15.9 (semver)

Date Public

2026-10-16 10:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://crates.io",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/television",
          "product": "television",
          "repo": "https://github.com/alexpasmantier/television",
          "vendor": "alexpasmantier",
          "versions": [
            {
              "lessThanOrEqual": "0.15.9",
              "status": "affected",
              "version": "0.15.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-10-16T10:00:03.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T13:55:13.736Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/alexpasmantier/television/issues/1166"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml"
        },
        {
          "name": "VulnCheck Advisory: Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting"
        }
      ],
      "title": "Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-112263",
    "datePublished": "2026-10-19T13:55:13.736Z",
    "dateReserved": "2026-10-19T13:25:23.451Z",
    "dateUpdated": "2026-10-19T13:55:13.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111876 (GCVE-0-2026-111876)

Vulnerability from nvd – Published: 2026-10-18 05:45 – Updated: 2026-10-19 19:05

Title

alexpasmantier television entry.rs output command injection

Summary

A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label "not planned".

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

5.3 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 19:05 UTC

CWE

CWE-77 - Command Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3913 records in the last 180 days details

References

7 references

URL	Tags
https://vuldb.com/vuln/421588	vdb-entrytechnical-description
https://vuldb.com/vuln/421588/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-111876	third-party-advisory
https://vuldb.com/submit/1005368	third-party-advisory
https://github.com/alexpasmantier/television/issu…	issue-tracking
https://github.com/alexpasmantier/television/pull/1125	issue-trackingpatch
https://github.com/alexpasmantier/television/	product

Impacted products

1 product

Vendor	Product	Version
alexpasmantier	television	Affected: 0.15.0 Affected: 0.15.1 Affected: 0.15.2 Affected: 0.15.3 Affected: 0.15.4 Affected: 0.15.5 Affected: 0.15.6 Affected: 0.15.7 Affected: 0.15.8 Affected: 0.15.9 cpe:2.3:a:alexpasmantier:television::::::::

Credits

carfeii (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111876",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T19:05:16.095380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:05:34.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/alexpasmantier/television/issues/1124"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:alexpasmantier:television:*:*:*:*:*:*:*:*"
          ],
          "product": "television",
          "vendor": "alexpasmantier",
          "versions": [
            {
              "status": "affected",
              "version": "0.15.0"
            },
            {
              "status": "affected",
              "version": "0.15.1"
            },
            {
              "status": "affected",
              "version": "0.15.2"
            },
            {
              "status": "affected",
              "version": "0.15.3"
            },
            {
              "status": "affected",
              "version": "0.15.4"
            },
            {
              "status": "affected",
              "version": "0.15.5"
            },
            {
              "status": "affected",
              "version": "0.15.6"
            },
            {
              "status": "affected",
              "version": "0.15.7"
            },
            {
              "status": "affected",
              "version": "0.15.8"
            },
            {
              "status": "affected",
              "version": "0.15.9"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "carfeii (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label \"not planned\"."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-18T05:45:17.843Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-421588 | alexpasmantier television entry.rs output command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/421588"
        },
        {
          "name": "VDB-421588 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/421588/cti"
        },
        {
          "name": "CVE-2026-111876 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-111876"
        },
        {
          "name": "Submit #1005368 | https://github.com/alexpasmantier/ television commit 9d2925b Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1005368"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/alexpasmantier/television/issues/1124"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/alexpasmantier/television/pull/1125"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/alexpasmantier/television/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-17T11:56:55.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "alexpasmantier television entry.rs output command injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-111876",
    "datePublished": "2026-10-18T05:45:17.843Z",
    "dateReserved": "2026-10-17T09:51:49.510Z",
    "dateUpdated": "2026-10-19T19:05:34.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112263 (GCVE-0-2026-112263)

Vulnerability from cvelistv5 – Published: 2026-10-19 13:55 – Updated: 2026-10-19 13:55

Title

Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting

Summary

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6503 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/alexpasmantier/television/issu…	issue-tracking
https://github.com/alexpasmantier/television/comm…	patch
https://github.com/alexpasmantier/television/comm…	patch
https://github.com/alexpasmantier/television/blob…	technical-description
https://github.com/alexpasmantier/television/blob…	technical-description
https://www.vulncheck.com/advisories/television-0…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
alexpasmantier	television	Affected: 0.15.0 , ≤ 0.15.9 (semver)

Date Public

2026-10-16 10:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://crates.io",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/television",
          "product": "television",
          "repo": "https://github.com/alexpasmantier/television",
          "vendor": "alexpasmantier",
          "versions": [
            {
              "lessThanOrEqual": "0.15.9",
              "status": "affected",
              "version": "0.15.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-10-16T10:00:03.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T13:55:13.736Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/alexpasmantier/television/issues/1166"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/alexpasmantier/television/commit/d7d46abb791181a3b5b6eed05e72aafcaa0ef269"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/alexpasmantier/television/commit/32695ccc6cd2b05cf7f1d3b80c24e324d5343eec"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/alexpasmantier/television/blob/0.15.9/television/utils/command.rs"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/alexpasmantier/television/blob/0.15.9/cable/unix/files.toml"
        },
        {
          "name": "VulnCheck Advisory: Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/television-0.15.0-through-0.15.9-os-command-injection-via-external-action-formatting"
        }
      ],
      "title": "Television 0.15.0 through 0.15.9 OS Command Injection via External Action Formatting",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-112263",
    "datePublished": "2026-10-19T13:55:13.736Z",
    "dateReserved": "2026-10-19T13:25:23.451Z",
    "dateUpdated": "2026-10-19T13:55:13.736Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111876 (GCVE-0-2026-111876)

Vulnerability from cvelistv5 – Published: 2026-10-18 05:45 – Updated: 2026-10-19 19:05

Title

alexpasmantier television entry.rs output command injection

Summary

A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label "not planned".

Severity

4.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

5.3 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 19:05 UTC

CWE

CWE-77 - Command Injection
CWE-74 - Injection

Assigner

VulDB CNA under the mitre root

CNA scorecard B 82/100 over 3913 records in the last 180 days details

References

7 references

URL	Tags
https://vuldb.com/vuln/421588	vdb-entrytechnical-description
https://vuldb.com/vuln/421588/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-111876	third-party-advisory
https://vuldb.com/submit/1005368	third-party-advisory
https://github.com/alexpasmantier/television/issu…	issue-tracking
https://github.com/alexpasmantier/television/pull/1125	issue-trackingpatch
https://github.com/alexpasmantier/television/	product

Impacted products

1 product

Vendor	Product	Version
alexpasmantier	television	Affected: 0.15.0 Affected: 0.15.1 Affected: 0.15.2 Affected: 0.15.3 Affected: 0.15.4 Affected: 0.15.5 Affected: 0.15.6 Affected: 0.15.7 Affected: 0.15.8 Affected: 0.15.9 cpe:2.3:a:alexpasmantier:television::::::::

Credits

carfeii (VulDB User) VulDB CNA Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111876",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T19:05:16.095380Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T19:05:34.026Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/alexpasmantier/television/issues/1124"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:alexpasmantier:television:*:*:*:*:*:*:*:*"
          ],
          "product": "television",
          "vendor": "alexpasmantier",
          "versions": [
            {
              "status": "affected",
              "version": "0.15.0"
            },
            {
              "status": "affected",
              "version": "0.15.1"
            },
            {
              "status": "affected",
              "version": "0.15.2"
            },
            {
              "status": "affected",
              "version": "0.15.3"
            },
            {
              "status": "affected",
              "version": "0.15.4"
            },
            {
              "status": "affected",
              "version": "0.15.5"
            },
            {
              "status": "affected",
              "version": "0.15.6"
            },
            {
              "status": "affected",
              "version": "0.15.7"
            },
            {
              "status": "affected",
              "version": "0.15.8"
            },
            {
              "status": "affected",
              "version": "0.15.9"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "carfeii (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label \"not planned\"."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4.3,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-18T05:45:17.843Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-421588 | alexpasmantier television entry.rs output command injection",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/421588"
        },
        {
          "name": "VDB-421588 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/421588/cti"
        },
        {
          "name": "CVE-2026-111876 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-111876"
        },
        {
          "name": "Submit #1005368 | https://github.com/alexpasmantier/ television commit 9d2925b Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/1005368"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/alexpasmantier/television/issues/1124"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/alexpasmantier/television/pull/1125"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/alexpasmantier/television/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-17T11:56:55.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "alexpasmantier television entry.rs output command injection",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-111876",
    "datePublished": "2026-10-18T05:45:17.843Z",
    "dateReserved": "2026-10-17T09:51:49.510Z",
    "dateUpdated": "2026-10-19T19:05:34.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

4 vulnerabilities by alexpasmantier

CVE-2026-112263 (GCVE-0-2026-112263)

CVE-2026-111876 (GCVE-0-2026-111876)

CVE-2026-112263 (GCVE-0-2026-112263)

CVE-2026-111876 (GCVE-0-2026-111876)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

4 vulnerabilities by alexpasmantier

CVE-2026-112263 (GCVE-0-2026-112263)

CVE-2026-111876 (GCVE-0-2026-111876)

CVE-2026-112263 (GCVE-0-2026-112263)

CVE-2026-111876 (GCVE-0-2026-111876)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.