CVE-2026-100856

HIGHCVSS 8.8

Description

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.

Timeline

Published:September 27th, 2026 2:17 AM

Last modified:September 28th, 2026 9:02 PM

CVSS Scoring

CVSS v3: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94

References & Reports

Advisories, patches, and third-party reports

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8
https://www.vulncheck.com/advisories/azuracast-before-0.23.6-code-injection-via-remote-relay-password
https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8

Source: NIST NVD · Data may lag official sources by up to one minute