{"id":"CVE-2026-100856","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-100856","generatedAt":"2026-10-27T23:45:30.106Z","title":"AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString.","description":"AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute arbitrary code in the Liquidsoap process, disclose internal API keys, or disrupt station operation.","published":"2026-09-27T02:17:25.000Z","lastModified":"2026-10-08T16:17:00.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-94"],"affected":[],"epss":{"score":0.00468,"percentile":0.40263,"date":"2026-10-26","history":[{"date":"2026-09-27","score":0.0037,"percentile":0.28391}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-09-27T02:17:25.000Z","detail":{"score":"8.7","severity":"HIGH","publishedAt":"2026-09-27T02:17:25.050Z"},"summary":"New CVE, high severity (CVSS 8.7)."}],"references":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/azuracast-before-0.23.6-code-injection-via-remote-relay-password","source":"disclosure@vulncheck.com"},{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-q4ph-8x8g-95f8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100856","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}