Cloudanix VulnDB

GHSA-93fx-5qgc-wr38

High · 8.7

AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs

CVSS

8.7

EPSS

—

Published

Mar 9, 2026

CISA due date

—

The record

AzuraCast's `ConfigWriter::cleanUpString()` method fails to sanitize Liquidsoap string interpolation sequences (`#{...}`), allowing authenticated users with `StationPermissions::Media` or `StationPermissions::Profile` permissions to inject arbitrary Liquidsoap code into the generated configuration file. When the station is restarted and Liquidsoap parses the config, `#{...}` expressions are evaluated, enabling arbitrary command execution via Liquidsoap's `process.run()` function.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities