Code Injection in AzuraCast via Liquidsoap Interpolation

Executive Summary

CVE-2026-100857 is a Remote Code Execution (RCE) vulnerability in AzuraCast versions 0.23.3 and earlier. It occurs because the ConfigWriter::cleanUpString() method does not properly sanitize Liquidsoap string interpolation sequences like #{...}. Authenticated users with Media or Profile permissions can inject malicious Liquidsoap code into station configuration files. When the station restarts, Liquidsoap evaluates these sequences, allowing command execution via process.run().

Useful 0 Not Useful 0

Detection Guidance

Check AzuraCast logs for suspicious Liquidsoap configuration changes or unexpected station restarts. Inspect playlist URLs and station metadata fields for Liquidsoap interpolation sequences like #{process.run()}. Use commands like grep to search for '#{' in configuration files or database entries.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Media or Profile permissions could inject malicious code into playlist URLs or station metadata. When the station restarts, this code executes arbitrary shell commands as the azuracast user, potentially compromising the entire server. The attacker gains full control over the AzuraCast system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. A successful exploit may expose sensitive user data, resulting in non-compliance, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AzuraCast to version 0.23.4 or later. Review and remove any unauthorized Liquidsoap interpolation sequences in playlist URLs or station metadata. Restrict Media and Profile permissions to trusted users only.

Useful 0 Not Useful 0