AzuraCast EUVD-2026-87822

Requires an authenticated AzuraCast account with StationPermissions::Media (to set a playlist remote_url) or StationPermissions::Profile (to set station name/description/genre/url, live_broadcast_text, or dj_mount_point). The malicious payload must be a Liquidsoap string-interpolation sequence (#{...} invoking process.run()) placed in one of those fields. Execution is NOT immediate: it fires only when the affected station's Liquidsoap backend is restarted and re-parses the generated .liq config (the UI:P/interaction-dependent step), so a station restart is a hard prerequisite. Exploitation is limited by needing valid credentials with the relevant permission and applies to AzuraCast <= 0.23.3; it is fixed in 0.23.4. Commands run with the privileges of the azuracast service user, not root.

This is a genuine remote code execution flaw (CWE-94) with strong technical impact, but its real-world priority is tempered by an authentication requirement and a delayed, interaction-dependent trigger. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:P/VC:H/VI:H/VA:H = 8.6) is internally consistent with the description: network-reachable API, low attacker complexity, but requiring a valid account holding Media or Profile permissions (PR:L, not unauthenticated) and passive interaction (UI:P) because injected code only executes when the station's Liquidsoap backend restarts. No EPSS score, no CISA KEV listing, and no in-the-wild data are provided, so there is no evidence of active exploitation - however, a detailed proof-of-concept IS embedded in the GHSA advisory (two working PoCs with exact HTTP requests), so publicly available exploit code exists. The combination of a reliable public PoC, full C/I/A impact, and trivial complexity makes this a real, actionable RCE for any AzuraCast operator, though the PR:L gate and low deployment footprint keep it below the tier of an unauthenticated, mass-exploitable bug. Net: prioritize patching to 0.23.4 for exposed multi-tenant AzuraCast instances, but this is targeted (needs an account) rather than internet-wide wormable. No SSVC decision fields were supplied in the input.

An authenticated AzuraCast user holding only Media or Profile station permissions submits a playlist remote URL or station metadata field (e.g. description, genre, name) containing a Liquidsoap interpolation payload such as http://x#{process.run('id > /tmp/pwned')}.example.com/stream. The unsanitized value is written verbatim into the generated liquidsoap.liq config, and when the station backend is (re)started the #{process.run(...)} expression is evaluated, executing arbitrary shell commands as the azuracast OS user. A complete PoC with exact API requests is published in the GHSA advisory, lowering the barrier to exploitation.