CVE-2026-121429: AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()

Published Nov 3, 2026

Updated

AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereotoolconfigurationpath or stereotoollicensekey, which are executed via /bin/sh on station restart, compromising the container.

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

A station user with Profile permission can exploit it. The attacker must be able to modify StereoTool settings for the station.

What attacker interaction is required for command execution?

The attacker can place shell metacharacters in stereo_tool_configuration_path or stereo_tool_license_key. The injected command executes through /bin/sh when the station is restarted.

What is compromised if exploitation succeeds?

Successful exploitation can compromise the AzuraCast container, with high impact to confidentiality, integrity, and availability.

CVE-2026-121429: AzuraCast through 0.23.8 Command Injection via StereoTool Liquidsoap pipe()

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What attacker interaction is required for command execution?

What is compromised if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What attacker interaction is required for command execution?

What is compromised if exploitation succeeds?