CVE-2026-100857

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.4

Description An issue exists in the ConfigWriter::cleanUpString() function that fails to sanitize Liquidsoap string interpolation sequences. Authenticated users with Media or Profile permissions can exploit this by injecting arbitrary Liquidsoap code into station configuration. Specifically, by inserting #{process.run()} expressions into playlist URLs or station metadata fields, an attacker can execute shell commands as the azuracast user upon station restart.

Recommendations Update to version 0.23.4 or later.