CVE-2026-100856CWE-94code-injection

CVE-2026-100856

High · published September 27, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00370 · 29.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-27T06:17Z
References (3)
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8 · [email protected]https://www.vulncheck.com/advisories/azuracast-before-0.23.6-code-injection-via-remote-relay-password · [email protected]https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 27 SEP 01:28Z
    AzuraCast before 0.23.6 Code Injection via Remote Relay Password
    cvelistv5