AzuraCast before 0.23.6 Code Injection via Remote Relay Password
AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.
CVE-2026-100856
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-100856
AzuraCast
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "AzuraCast",
"product": "AzuraCast",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "0.23.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.23.6",
"versionType": "semver"
}
],
"packageURL": "pkg:composer/azuracast/azuracast",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-100856
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #12685 · Revision 1
- Added to Heist Feed
- Publisher date