Summary
Television (tv) versions 0.15.0 through 0.15.9 contain an OS command injection flaw in the handling of improperly escaped single quotes within format_command.
An attacker who can create or introduce a file with a crafted name may cause a triggered action, such as the default edit action, to execute shell commands with the victim's privileges.
Television (tv) versions 0.15.0 through 0.15.9 contain an OS command injection flaw in the handling of improperly escaped single quotes within format_command.
An attacker who can create or introduce a file with a crafted name may cause a triggered action, such as the default edit action, to execute shell commands with the victim's privileges.
Affected context
The vulnerability occurs in Television installations that use the affected format_command logic when constructing commands from file names or related user-controlled paths. Exploitation becomes risky when an attacker can plant or influence a file name and a victim subsequently triggers an action that invokes the default edit command.
The vulnerability occurs in Television installations that use the affected format_command logic when constructing commands from file names or related user-controlled paths. Exploitation becomes risky when an attacker can plant or influence a file name and a victim subsequently triggers an action that invokes the default edit command.
Exploit preconditions
- Attack surface: The command-formatting and action-execution path in Television.
- Required access: Ability to create, rename, or otherwise introduce a file with a crafted name in a location processed by the application.
- Trigger point: A victim or automated workflow invokes an action such as the default edit action.
- Why exploitation is possible: Improper escaping of single quotes allows file-name content to alter the constructed shell command rather than remain data-only.
- Attack surface: The command-formatting and action-execution path in Television.
- Required access: Ability to create, rename, or otherwise introduce a file with a crafted name in a location processed by the application.
- Trigger point: A victim or automated workflow invokes an action such as the default edit action.
- Why exploitation is possible: Improper escaping of single quotes allows file-name content to alter the constructed shell command rather than remain data-only.
Why this happens
The underlying bug is an OS command injection condition caused by composing a shell command from insufficiently escaped file-name data. When input containing shell-significant characters is interpolated into a command string, the shell may interpret part of that data as command syntax. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
The underlying bug is an OS command injection condition caused by composing a shell command from insufficiently escaped file-name data. When input containing shell-significant characters is interpolated into a command string, the shell may interpret part of that data as command syntax. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- An attacker may execute arbitrary shell commands with the victim's privileges.
- Local files and application data could be read, modified, or deleted.
- The affected user's account or session could be compromised.
- Malicious commands could modify files, establish persistence, or affect connected systems.
- An attacker may execute arbitrary shell commands with the victim's privileges.
- Local files and application data could be read, modified, or deleted.
- The affected user's account or session could be compromised.
- Malicious commands could modify files, establish persistence, or affect connected systems.
General mitigation guidance
Mitigation generally focuses on eliminating shell interpretation and reducing trust in file-name data.
Common defensive patterns include:
- Prefer direct process execution APIs that accept an argument array rather than building shell command strings.
- Treat file names and paths as untrusted data, even when they originate from local storage.
- Apply context-appropriate escaping only when shell execution cannot be avoided, and keep command construction centralized.
- Use allowlisted editor or action configurations instead of accepting arbitrary command templates.
- Run the application with least-privilege accounts and restrict filesystem and process permissions.
- Add regression tests covering shell metacharacters, quotes, whitespace, and unusual Unicode in file names.
Mitigation generally focuses on eliminating shell interpretation and reducing trust in file-name data.
Common defensive patterns include:
- Prefer direct process execution APIs that accept an argument array rather than building shell command strings.
- Treat file names and paths as untrusted data, even when they originate from local storage.
- Apply context-appropriate escaping only when shell execution cannot be avoided, and keep command construction centralized.
- Use allowlisted editor or action configurations instead of accepting arbitrary command templates.
- Run the application with least-privilege accounts and restrict filesystem and process permissions.
- Add regression tests covering shell metacharacters, quotes, whitespace, and unusual Unicode in file names.
How teams detect issues like this
Detection can include static analysis for shell-spawning APIs, string interpolation near process execution, and command templates that incorporate file names or paths. Code review should flag manual quoting, incomplete escaping, and APIs that invoke a shell when direct argument-based execution is available. Runtime monitoring and policy enforcement can alert on unexpected child processes launched by the application, while automated security review tools may help identify command-construction patterns during development.
Detection can include static analysis for shell-spawning APIs, string interpolation near process execution, and command templates that incorporate file names or paths. Code review should flag manual quoting, incomplete escaping, and APIs that invoke a shell when direct argument-based execution is available. Runtime monitoring and policy enforcement can alert on unexpected child processes launched by the application, while automated security review tools may help identify command-construction patterns during development.
