High severity8.8NVD Advisory· Published Sep 27, 2026

CVE-2026-100856

Description

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.

Affected products

AzuraCast/Azuracastllm-fuzzy
Range: <0.23.6

Patches

Vulnerability mechanics

References

github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8nvd
www.vulncheck.com/advisories/azuracast-before-0.23.6-code-injection-via-remote-relay-passwordnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000