AzuraCast EUVD-2026-87821

Requires an authenticated AzuraCast account (<= 0.23.5) holding the RemoteRelays station permission for the target station; the attacker sets the remote relay password field to a nested Liquidsoap interpolation payload (#{#{EXPR}}) that defeats the ungreedy /#{(.*)}/U regex in cleanUpString(). Exploitation does not require a specific non-default feature toggle beyond having remote relay functionality in use, and needs no user interaction. Limiting factors: the RemoteRelays privilege gate (PR:L, not unauthenticated), and that the payload only executes when the Liquidsoap configuration is (re)generated and loaded for the station.

This is a genuine high-priority issue for AzuraCast operators, though gated by authentication. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.7) is internally consistent and I agree with it: network-reachable, low complexity, no user interaction, requiring only the low-privilege RemoteRelays station permission, and yielding full code execution in the Liquidsoap process (high confidentiality, integrity, and availability impact). The impact triad is credible because arbitrary Liquidsoap code execution can leak internal API keys and disrupt station streaming. The mitigating signal is PR:L - this is not an unauthenticated flaw; an attacker needs a valid account holding the RemoteRelays permission on a station, which limits exposure to insiders or compromised sub-accounts in multi-tenant deployments. No EPSS score, no CISA KEV listing, and no separately published weaponized exploit were provided, so there is no evidence of active exploitation; however, the GHSA advisory documents the regex-bypass mechanics and the exact nested payload (#{#{EXPR}}) in PoC-grade detail, so a working exploit is trivially reconstructable. Net: a real code-execution vulnerability that warrants prompt patching, tempered from 'critical/urgent' to 'high but authentication-gated' by the PR:L requirement and the niche deployment footprint of the product.

An attacker who holds (or has phished/compromised) an AzuraCast account with the RemoteRelays station permission edits the remote relay password field, entering a nested Liquidsoap interpolation payload such as #{#{...}} that survives the flawed cleanUpString() sanitizer and lands as valid interpolation inside a double-quoted Liquidsoap output string. When the configuration is written and Liquidsoap evaluates it, the injected expression executes in the Liquidsoap process, allowing the attacker to run arbitrary code, read internal API keys, or knock the station offline. No weaponized exploit code was supplied, but the GHSA advisory lays out the exact bypass and payload structure in detail.