Live › vulnerability › CVE-2026-121429
AzuraCast through 0.23.8 lets a station user with Profile permission inject shell metacharacters into the StereoTool configuration path or license key. Those values are run through /bin/sh when the station restarts, which lets an attacker execute commands inside the container.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
AzuraCast instances up to and including 0.23.8 (the advisory says the code is also on main) where the StereoTool binary is installed and configured on a station. Any station user or API key with the Profile permission, not only admins, can set the StereoTool config path or license key and run OS commands as the Liquidsoap process user when the station backend starts or restarts. Multi-tenant or reseller hosts are most at risk. Instances without StereoTool installed, or where only trusted admins hold Profile permission, can skip it. StereoTool is an optional install, not on by default.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| azuracast/azuracast | composer | <= 0.23.8 | – |
0.23.9 (Oct 21, 2026) only updates PHPCHANGELOG listsImproved the security around StereoTool invocation in Liquidsoap' under Rolling Release Changes (not yet in a stable release), so move to the latest rolling release channel build, or apply mitigations below until a stable version shipsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.
This page as .md · .json · in your agent: get_signal("CVE-2026-121429")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.