Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-100856AzuraCast before 0.23.6 Code Injection via Remote Relay Password

High 8.8

In plain English

A high-severity code injection in AzuraCast from AzuraCast. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 59.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	azuracast/azuracast	0.23.6	GHSA-q4ph-8x8g-95f8

Affected products (as reported)

Vendor	Product	Versions
AzuraCast	AzuraCast	0 – before 0.23.6

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-q4ph-8x8g-95f8) vendor-advisory
VulnCheck Advisory: AzuraCast before 0.23.6 Code Injection via Remote Relay Password third-party-advisory