High priorityDisclosed

Advisory · CVE-2026-100857

AzuraCast station fields smuggle shell commands into Liquidsoap

AzuraCast's config writer fails to sanitize Liquidsoap string interpolation, so Media or Profile users can inject shell commands that run when the station restarts.

Advisory published September 27, 2026Independent summary
Vendor
AzuraCast
Product
AzuraCast
Identifier / CWE
CVE-2026-100857
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

AzuraCast has a cleaning step for text that is supposed to remove booby traps, but it misses a type of trap. A user can hide 'run this command' in a playlist link or station name, and it fires when the station restarts.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Interpolation injected

    An authenticated user with Media or Profile permissions injects #{process.run()} expressions into playlist URLs or station metadata fields.

  2. 02Sanitization misses it

    ConfigWriter::cleanUpString() fails to sanitize Liquidsoap string interpolation sequences.

  3. 03Station restarts

    The poisoned values land in the generated station configuration and are consumed on station restart.

  4. 04Shell commands run

    The injected expressions execute shell commands as the azuracast user.

What happened

AzuraCast before 0.23.4 (CVE-2026-100857, CVSS 8.6) contains a code injection vulnerability in the ConfigWriter::cleanUpString() method, which fails to sanitize Liquidsoap string interpolation sequences.

Authenticated users with Media or Profile permissions can inject arbitrary Liquidsoap code into station configuration. Attackers can inject #{process.run()} expressions into playlist URLs or station metadata fields that execute shell commands as the azuracast user when the station restarts. Version 0.23.4 fixes the issue.

What to do

  1. Upgrade AzuraCast to 0.23.4 or later.
  2. Search station metadata, playlist URLs, and profile fields for interpolation sequences like #{.
  3. Review system and Liquidsoap logs for unexpected shell commands or station restarts.
  4. Narrow Media and Profile permissions to trusted operators.

Management note

This is the oldest of this week’s AzuraCast injection cluster, which suggests several independent reviews found the same weak sanitizer. Update past 0.23.8 to close the whole set, not just this one.