Television (tv) versions 0.15.0 through 0.15.9 contain an OS command injection vulnerability that permits an attacker to execute arbitrary shell commands. The flaw resides in the format_command function, where single quotes are not properly escaped and can be exploited through a malicious file name containing an apostrophe. When a user triggers an action such as the default edit action on the crafted file, the embedded shell command runs with the privileges of the running process, allowing full control over the system using only local privileges. This type of injection expands the attacker’s ability to maintain persistence, exfiltrate data, or modify system state.

The entire community of users running Television (tv) version 0.15.0 through 0.15.9 is affected, including those who maintain the repository at alexpasmantier/television on GitHub. Any deployment of these releases, regardless of the operating system, is susceptible to this flaw as it is triggered by file name handling and does not depend on external configuration. Users who maintain copy operations, file renaming, or edit capabilities on these versions should be aware of the vulnerability.

The CVSS score of 8.5 indicates a high severity risk, and the absence of an EPSS score suggests the exploitation probability is not publicly quantified but follows the typical weighting of a critical OS command injection. Because the vulnerability is purely local and does not require remote network access, attacker execution requires either physical or administrative access to the machine, or a privileged local user who can create files. The threat is exacerbated by the lack of a listed KEV entry, implying that no widespread public exploitation has been observed, yet the high severity warrants urgent attention. If a patch is unavailable, a temporary workaround of renaming files to avoid single quotes suffices, but the safest approach is to upgrade to a version where the format_command logic has been corrected.