CVE-2026-100857: Azuracast

High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days.

AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration. Attackers can inject #{process.run()} expressions into playlist URLs or station metadata fields that execute shell commands as the azuracast user when the station restarts.

Affected products

• Azuracast Azuracast: before 0.23.4 (fixed in 0.23.4)

Published 2026-09-27. Last modified 2026-10-08.