CVE-2026-100852CWE-78command-injection

CVE-2026-100852

High · published September 27, 2026

CVSS v3.1
8.8
EPSS
4%
Percentile
89.7
In the wild
Unconfirmed
What it is

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.03722 · 89.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-09-27T06:17Z
References (3)
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-73rf-jp3g-8rcf · [email protected]https://www.vulncheck.com/advisories/azuracast-through-0.23-x-command-injection-via-streamer-username · [email protected]https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-73rf-jp3g-8rcf · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 4%
    epss
  • 27 SEP 01:28Z
    AzuraCast through 0.23.x Command Injection via Streamer Username
    cvelistv5