Executive brief
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Affected products
- Packagist azuracast/azuracast
Junglewise Threat Intelligence
AzuraCast: RCE via Liquidsoap string interpolation injection in station metadata and playlist URLs
Severity: low · CVSS 3.1 · Published 2026-03-09
Technologies: azuracast/azuracast (Packagist). Vendors: Packagist.
Related threats
- AzuraCast password reset poisoning in ApplyXForwarded middleware
- AzuraCast path traversal and RCE in Flow.js media upload
- AzuraCast Vulnerable to Liquidsoap Code Injection via Incomplete cleanUpString-to-toRawString Migration in Remote Relay Password Field
- AzuraCast has Missing Permissions Check on Media File Download, Allowing Cross-Station Data Exfiltration
- AzuraCast's Missing RequireInternalConnection on Liquidsoap API Allows Low-Privilege Metadata Injection and Broadcast Disruption