SB2026102506 - OS Command Injection in AzuraCast

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102506

SB2026102506 - OS Command Injection in AzuraCast

Published: October 25, 2026

Security Bulletin ID SB2026102506
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary OS commands as the AzuraCast/Liquidsoap process user, compromising the confidentiality, integrity, and availability of application data.

The vulnerability exists due to improper neutralization of shell metacharacters in AzuraCast's Liquidsoap configuration writer when constructing the StereoTool pipe() command from stereo_tool_configuration_path and stereo_tool_license_key. A remote user can submit a profile update to PUT /api/station/{id}/profile/edit with the Profile permission, setting stereo_tool_configuration_path to "x ; id > /tmp/pwned ;#" or injecting shell commands through stereo_tool_license_key, to execute arbitrary commands through /bin/sh -c when the station backend starts or restarts.


Remediation

Install update from vendor's website.

References