CVE-2026-100852: AzuraCast through 0.23.x Command Injection via Streamer Username
AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.
Other sources
AzuraCast through 0.23.x contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AzuraCastto a version that resolves this vulnerability.Fixed in 0.23.8
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated station user needs both Streamers and Profile permissions. They can set a streamer username containing shell metacharacters and cause execution when live recording closes.
Under what conditions is a deployment exposed?
The vulnerable path is the Liquidsoap configuration generation used for live recording. Exploitation requires a user who can modify a streamer username and a recording session that subsequently closes.
What account context runs the injected command?
The injected command executes as the Liquidsoap process user. The resulting access is limited or expanded according to that process user's permissions.