Command Injection Vulnerability in alexpasmantier Television Software
CVE-2026-111876

4.8MEDIUM

Key Information:

Vendor

Alexpasmantier

Status
Television
Vendor
CVE Published:
18 October 2026

What is CVE-2026-111876?

A command injection vulnerability has been identified in the 'output' function of the Entry component within the alexpasmantier television software, specifically affecting versions up to 0.15.9. By manipulating the 'raw' argument, an attacker can execute arbitrary commands on the local system. This local exploitation does not require remote access, making it a significant concern for users of the software. The associated GitHub issue has been marked as 'not planned', indicating no immediate resolution or patch is in progress.

Affected Version(s)

television 0.15.0

television 0.15.1

television 0.15.2

References

https://vuldb.com/vuln/421588
vdb-entrytechnical-description
https://vuldb.com/vuln/421588/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-111876
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

carfeii (VulDB User)
VulDB CNA Team
.