CVE-2026-111876CWE-74CWE-77command-injection

CVE-2026-111876

Medium · published October 18, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
49.2
In the wild
Unconfirmed
What it is

A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file television/channels/entry.rs. Performing a manipulation of the argument raw results in command injection. The attack requires a local approach. The reported GitHub issue was closed with the label "not planned".

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00624 · 49.2th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-10-18T10:16Z
References (8)
https://github.com/alexpasmantier/television/ · [email protected]https://github.com/alexpasmantier/television/issues/1124 · [email protected]https://github.com/alexpasmantier/television/pull/1125 · [email protected]https://vuldb.com/cve/CVE-2026-111876 · [email protected]https://vuldb.com/submit/1005368 · [email protected]https://vuldb.com/vuln/421588 · [email protected]https://vuldb.com/vuln/421588/cti · [email protected]https://github.com/alexpasmantier/television/issues/1124 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 18 OCT 05:45Z
    alexpasmantier television entry.rs output command injection
    cvelistv5
  • 18 OCT 05:45Z
    alexpasmantier television entry.rs output command injection
    cvelistv5