{"schema":"threatline.record/2","record":{"id":"CVE-2026-100857","aliases":["GHSA-93fx-5qgc-wr38"],"summary":"AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation","details":"AzuraCast before 0.23.4 contains a code injection vulnerability in the ConfigWriter::cleanUpString() method that fails to sanitize Liquidsoap string interpolation sequences, allowing authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code into station configuration. Attackers can inject #{process.run()} expressions into playlist URLs or station metadata fields that execute shell commands as the azuracast user when the station restarts.","categories":["Libraries & packages"],"product":"AzuraCast","vendor":"AzuraCast","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100857","source_modified_at":"2026-10-08T15:22:06.208Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"AzuraCast","vendor":"AzuraCast","versions":[{"lessThan":"0.23.4","status":"affected","version":"0","versionType":"semver"},{"status":"unaffected","version":"0.23.4","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-93fx-5qgc-wr38","source_modified_at":"2026-09-27T11:56:07.738226089Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"azuracast/azuracast","ecosystem":"Packagist","purl":"pkg:composer/azuracast/azuracast"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.4"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.11","0.11.1","0.11.2","0.12","0.12.1","0.12.2","0.12.3","0.12.4","0.13.0","0.14.0","0.14.1","0.15.0","0.15.1","0.15.2","0.16.0","0.16.1","0.17.0","0.17.1","0.17.2","0.17.3","0.17.4","0.17.5","0.17.6","0.17.7","0.18.0","0.18.1","0.18.2","0.18.3","0.18.5","0.19.0","0.19.1","0.19.2","0.19.3","0.19.4","0.19.5","0.19.6","0.19.7","0.20.0","0.20.1","0.20.2","0.20.3","0.20.4","0.21.0","0.22.0","0.22.1"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100857","source_modified_at":"2026-10-08T15:22:06.208Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"AzuraCast","ecosystem":null},"version":"0.23.4","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-93fx-5qgc-wr38","source_modified_at":"2026-09-27T11:56:07.738226089Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"azuracast/azuracast","ecosystem":"Packagist","purl":"pkg:composer/azuracast/azuracast"},"version":"0.23.4"}],"cvss":8.6,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00336,"percentile":0.25747,"score_date":"2026-10-23"},"published_at":"2026-09-27T01:28:48.450Z","modified_at":"2026-10-08T15:22:06.208Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100857","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-08T15:22:06.208Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-93fx-5qgc-wr38","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-27T11:56:07.738226089Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100857","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-93fx-5qgc-wr38","tags":["exploit"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/azuracast-before-0.23.4-remote-code-execution-via-liquidsoap-string-interpolation","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-09-28T13:32:35.358121Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-08T15:22:06.208Z","content_hash":"fe9ff3556bf777ce53475a363e1f7901f872c6ff94406f663baf42f354bde6b2"}}