Submit #1005368: https://github.com/alexpasmantier/ television commit 9d2925b Command Injection

Selected entry printed on exit isn't stripped of terminal escape sequences, allowing injection via a crafted file name

Affected versions: confirmed on the tip of `main`, commit 9d2925b (2026-07-31), released version 0.15.9

## Summary

tv's interactive TUI is built on ratatui, which correctly renders control characters as safe placeholder glyphs on screen. However, tv's own primary intended usage, piping the selected entry into another command after exiting (`cd "$(tv)"`, `nvim "$(tv)"`, etc.), prints that selection directly to the terminal after the TUI has already stopped, bypassing ratatui's protection entirely. The default "files" channel searches file names in the current directory, which have no character restrictions, so selecting a crafted file name causes any escape sequence it contains to be written to the terminal and interpreted live.

## Details

`television/channels/entry.rs`, `Entry::output`, defaults to the raw value captured from the source channel:
```rust
pub fn output(&self) -> Result<String> {
if let Some(output) = &self.output {
output.format(&self.raw)
} else {
Ok(self.raw.clone())
}
}
```

`television/main.rs`, the sole print site for a selected entry, reached after the TUI has already exited:
```rust
if let Some(entries) = output.selected_entries {
for entry in &entries {
writeln!(bufwriter, "{}", entry.output()?)?;
}
}
```
No filtering of control characters happens before this write.

## POC

(available upon request)

## Impact

tv writes a selected entry's value to the terminal exactly as captured from its source channel, with no stripping of control characters or escape sequences, after the TUI has exited. Since running tv in a directory to select and act on a file (the tool's own primary, advertised use case, e.g. `cd "$(tv)"`) is routine, ordinary use, a crafted file name in that directory causes any embedded escape sequence to be written to the terminal and interpreted live. I demonstrated this with a benign OSC title-set marker rather than a more aggressive payload, since confirming the sequence reaches output unmodified is sufficient to establish the defect; the specific range of what an injected OSC/CSI sequence can achieve depends on the victim's terminal emulator and wasn't enumerated further. Within the TUI itself, ratatui correctly renders the control bytes as a safe placeholder glyph, confirming this is specifically a post-exit print bypassing that protection, not a gap in ratatui's own rendering.

I have a fix ready and will follow up with a PR.

• Source: ⚠️ https://github.com/alexpasmantier/television/issues/1124
• User: carfeii (UID 97470)
• Submission: 09/29/2026 15:57 (28 days ago)
• Moderation: 10/17/2026 11:51 (18 days later)
• Status: Accepted
• VulDB entry: 421588 [alexpasmantier television up to 0.15.9 entry.rs Entry::output raw command injection]
• Points: 20