Description
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
Published: 2026-09-27
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

AzuraCast versions earlier than 0.23.6 are susceptible to a code injection flaw triggered via the remote relay password field. The vulnerability originates from incomplete migration from the legacy cleanUpString routine to toRawString, allowing attackers with RemoteRelays station permissions to inject Liquidsoap interpolation syntax. Successfully exploiting the flaw can lead to the execution of arbitrary code within the Liquidsoap process, disclosure of sensitive API keys, and disruption of station operations.

Affected Systems

AzuraCast platform, versions prior to 0.23.6. The flaw touches the remote relay password configuration used by stations that grant RemoteRelays permission.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, but the lack of mitigation in public releases suggests that exploitation is possible if an attacker can obtain the required station permission. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to target a station with RemoteRelays permissions to inject the malicious Liquidsoap payload and achieve remote code execution.

Generated by OpenCVE AI on September 27, 2026 at 03:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the AzuraCast update to version 0.23.6 or newer to remove the injection point
  • Restrict or revoke RemoteRelays station permissions for users who do not require this capability
  • If an immediate update is not feasible, disable the remote relay feature entirely until the patch is applied

Generated by OpenCVE AI on September 27, 2026 at 03:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
Description AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
Title AzuraCast before 0.23.6 Code Injection via Remote Relay Password
First Time appeared Azuracast
Azuracast azuracast
Weaknesses CWE-94
CPEs cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*
Vendors & Products Azuracast
Azuracast azuracast
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Azuracast Azuracast
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-27T01:28:47.778Z

Reserved: 2026-09-27T00:20:03.854Z

Link: CVE-2026-100856

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-27T02:17:25.050

Modified: 2026-09-27T02:17:25.050

Link: CVE-2026-100856

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T05:30:17Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')