CVE-2026-100856
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field…
- Risk score
- 59/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 27 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liqui…
- Affected
- See advisory
- Fix
- Upgrade the product to 0.23.6 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
Last activity 27 Sep 2026. Patch Forecast updates every hour.