Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the remote relay password field due to incomplete migration from the cleanUpString method to toRawString. An attacker can execute arbitrary code in the Liquidsoap process, disclose internal API keys, or...

CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...

CVE-2026-100856

AzuraCast versions prior to 0.23.6 are vulnerable to a code injection vulnerability within the remote relay password field. The root cause is an incomplete migration from the vulnerable cleanUpString method to toRawString. An attacker with RemoteRelays station permission can inject nested Liquids...

CVE-2026-100856 AzuraCast before 0.23.6 Code Injection via Remote Relay Password

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the cleanUpString function. An attacker can execute arbitrary code, disclose internal API keys, or disrupt service operation by supplying crafted input to the remote relay password field, which is processed...

GHSA-Q4PH-8X8G-95F8 AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

Summary The cleanUpString method in ConfigWriter.php uses an ungreedy regex to strip Liquidsoap string interpolation patterns ... from user input. This regex can be bypassed via nested interpolation syntax EXPR, allowing injection of arbitrary Liquidsoap code. Commit ff49ef4 migrated most...

AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field

Summary The cleanUpString method in ConfigWriter.php uses an ungreedy regex to strip Liquidsoap string interpolation patterns ... from user input. This regex can be bypassed via nested interpolation syntax EXPR, allowing injection of arbitrary Liquidsoap code. Commit ff49ef4 migrated most...