Command Injection Vulnerability in AzuraCast Product by AzuraCast
CVE-2026-100852

8.7HIGH

Key Information:

Vendor

Azuracast

Status
Azuracast
Vendor
CVE Published:
27 September 2026

What is CVE-2026-100852?

AzuraCast, up to version 0.23.x, is susceptible to a command injection vulnerability in its Liquidsoap configuration generation for live recording. The flaw arises because the application fails to properly quote the streamer username during the process.run calls. This oversight allows authenticated users with Streamer and Profile permissions to inject shell metacharacters into their username. Upon closing the recording, this action can result in executing arbitrary commands as the Liquidsoap process user, potentially compromising the security of the affected system.

Affected Version(s)

AzuraCast 0 <= 0.23.x

References

https://github.com/AzuraCast/AzuraCast/security/advisorie...
vendor-advisory
https://www.vulncheck.com/advisories/azuracast-through-0....
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alpastx
.