The vulnerability emerges from a command injection flaw in AzuraCast’s Liquidsoap configuration generation for live recording in versions prior to 0.23.8. When the streamer username is not properly quoted in process.run calls, an authenticated user with Streamer or Profile permissions can embed shell metacharacters in the username. When the recording stops, the Liquidsoap process executes the injected command as its own user, enabling arbitrary code execution at that privilege level. This weakness corresponds to CWE‑78 and grants an attacker the ability to compromise confidentiality, integrity, and availability of the server.

All AzuraCast releases up to and including version 0.23.x are affected. The vulnerability is present in the core AzuraCast product and is not limited to a specific deployment configuration. Versions 0.24.0 and later contain the fix that properly sanitizes streamer usernames in Liquidsoap commands.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is 4%, but the lack of a KEV listing does not diminish the risk because exploitation requires only legitimate station credentials with the appropriate permissions. In environments where hundreds of stations are hosted, a compromised streamer account can silently inject commands, potentially leading to system compromise. Attackers need only to set a malicious username; no additional infrastructure or physical access is required.