Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

alexpasmantier television lets local users run commands

CVE-2026-111876 · published today
Summary

The television software version up to 0.15.9 lets someone with local access change a setting in the Entry::output function to execute arbitrary system commands. This could let an attacker run unwanted programs on the machine. Update to a newer version or apply a patch if one is available, and limit local access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
alexpasmantier television 0.15.0
Original advisory text
alexpasmantier television entry.rs output command injection
A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label "not planned".
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-74Injection
CWE-77Command Injection
Timeline
Published18 Oct 2026
Updated19 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-111876 · NVD
CVE-2026-111876 · MITRE
CVE-2026-111876 · OSV
Track software like this
Free during beta