CVE-2026-100857 — AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, all…
Published: 2026-09-27 · CVSS: 8.6 · CVSS 4.0
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration. Attackers can inject #{process.run()} expressions into playlist URLs or station metadata fields that execute shell commands as the azuracast user when the station restarts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7