CVE-2026-100857CWE-94code-injection

CVE-2026-100857

High · published September 27, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration. Attackers can inject #{process.run()} expressions into playlist URLs or station metadata fields that execute shell commands as the azuracast user when the station restarts.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-09-27T06:17Z
References (3)
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-93fx-5qgc-wr38 · [email protected]https://www.vulncheck.com/advisories/azuracast-before-0.23.4-remote-code-execution-via-liquidsoap-string-interpolation · [email protected]https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-93fx-5qgc-wr38 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 28 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 27 SEP 01:28Z
    AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation
    cvelistv5