CVE-2026-121428

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

CVE-2026-121428

AzuraCast versions through 0.23.8 are vulnerable to Remote Code Execution (RCE) due to a Supervisor configuration injection flaw in the station timezone field. Authenticated station managers can exploit the profile edit API by submitting a timezone string containing newlines. This allows the inje...

EUVD-2026-115960

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

CVE-2026-121428 AzuraCast through 0.23.8 RCE via Supervisor Configuration Injection in Timezone

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

CVE-2026-121428: AzuraCast: AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to…

AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the backendconfig property deserialization in the profile edit API endpoint. An attacker can inject arbitrary configuration values that are written verbatim into the generated Liquidsoap script, enabling...