Is CVE-2026-112263 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-112263?

CVE-2026-112263 has a CVSS v3 severity of HIGH (7.8).

Back

CVE-2026-112263

Description

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through improperly escaped single quotes in format_command. Attackers can plant a file with a crafted name containing an apostrophe so that triggering an action like the default edit action executes commands with victim privileges.