CVE-2026-100857 in AzuraCast
Summary
by MITRE • 09/27/2026
AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration. Attackers can inject #{process.run()} expressions into playlist URLs or station metadata fields that execute shell commands as the azuracast user when the station restarts.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in AzuraCast versions prior to 0.23.4 represents a critical server-side code injection flaw located within the ConfigWriter::cleanUpString() method. This function is responsible for processing and sanitizing configuration strings before they are written to station configuration files, specifically those governing Liquidsoap, an audio streaming software used by AzuraCast. The core technical failure lies in the insufficient validation of input data intended for Liquidsoap string interpolation sequences. When users with Media or Profile permissions provide input through playlist URLs or station metadata fields, the system fails to properly escape or filter special characters and command execution syntax inherent to the Liquidsoap scripting language. This lack of rigorous sanitization allows an authenticated attacker to inject arbitrary code fragments that are subsequently interpreted as executable commands rather than static configuration data.
From a technical perspective, the exploitation vector relies on the specific behavior of Liquidsoap when it parses its configuration files upon station restart or reload. By injecting expressions such as #{process.run()}, which is a standard mechanism in Liquidsoap for executing external shell processes, an attacker can force the application to run arbitrary system commands. Because AzuraCast typically operates with elevated privileges relative to general web services but often runs under a dedicated user account like azuracast, this injection results in command execution within that specific security context. The impact is severe as it effectively grants remote code execution capabilities to any authenticated user possessing the specified permissions, bypassing intended access controls and allowing for complete compromise of the underlying server infrastructure hosting the radio station software.
The operational impact of this vulnerability extends beyond simple data manipulation or service disruption. An attacker can leverage this flaw to escalate privileges by executing commands that interact with system binaries, modify other configuration files, install backdoors, or exfiltrate sensitive data from the host machine. Since Liquidsoap runs as part of the AzuraCast stack, successful exploitation provides a persistent foothold on the server. This aligns closely with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where user input is directly incorporated into code generation without adequate sanitization. Furthermore, this attack pattern corresponds to MITRE ATT&CK techniques involving Command and Scripting Interpreter abuse, particularly those related to remote command execution via application layer protocols or configuration file manipulation.
Mitigation strategies must prioritize immediate software updates as the primary defense vector. Administrators running AzuraCast versions earlier than 0.23.4 should upgrade to the latest stable release where this sanitization logic has been corrected and input validation is enforced more strictly at multiple layers of the application stack. In environments where immediate patching is not feasible, temporary mitigations include restricting user permissions to remove Media or Profile access from untrusted accounts until the update can be applied. Additionally, implementing strict network segmentation to limit lateral movement in case of compromise and monitoring system logs for unusual process executions by the azuracast user can help detect potential exploitation attempts. Regular security audits focusing on input validation practices within configuration management modules are also recommended to prevent similar injection vulnerabilities in future development cycles.