OS Command Injection in AzuraCast - #VU157649
Published: October 25, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary OS commands as the AzuraCast/Liquidsoap process user, compromising the confidentiality, integrity, and availability of application data.
The vulnerability exists due to improper neutralization of shell metacharacters in AzuraCast's Liquidsoap configuration writer when constructing the StereoTool pipe() command from stereo_tool_configuration_path and stereo_tool_license_key. A remote user can submit a profile update to PUT /api/station/{id}/profile/edit with the Profile permission, setting stereo_tool_configuration_path to "x ; id > /tmp/pwned ;#" or injecting shell commands through stereo_tool_license_key, to execute arbitrary commands through /bin/sh -c when the station backend starts or restarts.