CVE-2026-121429

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.9

Description Station users with Profile permission can execute operating system commands through StereoTool settings. This occurs when shell metacharacters are injected into the stereo tool configuration path or stereo tool license key variables, which are then executed via /bin/sh during a station restart, leading to a compromise of the container.

Recommendations Update to version 0.23.9 or later. Restrict the use of the stereo tool configuration path and stereo tool license key variables until the update is applied.