Advisory · CVE-2026-100852
AzuraCast streamer names become shell commands
AzuraCast fails to quote streamer usernames in Liquidsoap config generation, so an authenticated station user gets command execution as the Liquidsoap user.
- Vendor
- AzuraCast
- Product
- AzuraCast
- Identifier / CWE
- CVE-2026-100852
CWE-78 - Action timing
- Immediate
Explain it like I’m five
AzuraCast writes a station's schedule card using whatever name a streamer typed, without checking for tricks. A streamer can sign up as 'DJ; delete everything' and AzuraCast says both parts out loud to the computer.
- 01Malicious username set
An authenticated station user with Streamers and Profile permissions sets a streamer username containing shell metacharacters.
- 02Config generated unquoted
The Liquidsoap config generation for live recording fails to quote the streamer username in process.run calls.
- 03Recording closes
When a recording closes, the generated config is consumed by Liquidsoap.
- 04Commands execute
The metacharacters are interpreted by the shell, executing commands as the Liquidsoap process user.
What happened
AzuraCast through 0.23.x (CVE-2026-100852, CVSS 8.8) contains a command injection vulnerability in the Liquidsoap config generation for live recording. The generation fails to quote the streamer username in process.run calls.
Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.
What to do
- Upgrade to a fixed AzuraCast release and follow the project advisory.
- Audit streamer usernames for shell metacharacters or unexpected content.
- Review Liquidsoap process and system logs for unusual commands executed around recording events.
- Narrow station-user permissions to the minimum each account needs.
Management note
User profile fields that feed config templates are injection surface. Any low-privilege station user could escalate to the service account running your broadcast stack.