CVE-2026-100857

Packagist/azuracast/azuracast CVE-2026-100857: high 8.7, EPSS 0.34%

AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs

Action: Upgrade azuracast/azuracast to 0.23.4 or later.

composer require azuracast/azuracast:0.23.4

Affected

Fixed versions

Sources

• osv: GHSA-93fx-5qgc-wr38
• https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-93fx-5qgc-wr38
• https://github.com/AzuraCast/AzuraCast/commit/d04b5c55ce0d867bcb87f49f7082bf8edbcd360c
• https://github.com/AzuraCast/AzuraCast/commit/ff49ef4d0fa571a3661abff6d0a9546ba3ed5df5
• https://github.com/AzuraCast/AzuraCast
• https://github.com/AzuraCast/AzuraCast/releases/tag/0.23.4

CVE-2026-100857 · published 2026-03-09T19:55:00Z · modified 2026-09-27T11:56:07.738226089Z · JSON