CVE-2026-100856

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.

CVSS 4.0

8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-25)

CWE

CWE-94

Published

2026-09-27

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

References

• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8
• https://www.vulncheck.com/advisories/azuracast-before-0.23.6-code-injection-via-remote-relay-password
• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8

Check your stackJSON