Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-100852AzuraCast before 0.23.8 Command Injection via Streamer Username

High 8.8

In plain English

A high-severity OS command injection in AzuraCast from AzuraCast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.6% (higher than 92% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)4.6%top 8.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AzuraCast before 0.23.8 contains a command injection vulnerability in the Liquidsoap config generation for live recording that fails to quote the streamer username in process.run calls. Authenticated station users with Streamers and Profile permissions can set a username containing shell metacharacters and trigger command execution as the Liquidsoap process user when recording closes.

Affected products (as reported)

Vendor	Product	Versions
AzuraCast	AzuraCast	0 – before 0.23.8

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-73rf-jp3g-8rcf) vendor-advisory
VulnCheck Advisory: AzuraCast through 0.23.x Command Injection via Streamer Username third-party-advisory