The vulnerability is located in the Entry::output function within television/channels/entry.rs. Manipulating the raw argument allows an attacker to execute arbitrary shell commands on the host, resulting in local code execution and the potential to elevate privileges. This compromises the confidentiality, integrity, and availability of the affected system.

All installations of alexpasmantier’s Television application up to and including version 0.15.9 are impacted. The product is the Television repository hosted by alexpasmantier on GitHub.

The CVSS score of 4.8 marks the issue as medium severity, while the EPSS score is not available. Because the attack requires local access and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of exploitation in the wild is low, but the risk is significant for any environment where local users can run the application. Exploiting the flaw locally is straightforward once the vulnerable code is present.