CVE-2026-121429 Details

A command injection vulnerability has been identified in AzuraCast versions through 0.23.8. This vulnerability allows station users with Profile permission to execute operating system commands by injecting shell metacharacters into StereoTool configuration settings. The injected commands are executed via /bin/sh when the station is restarted, potentially compromising the container. The issue arises because user input is directly concatenated into a shell command without proper escaping, allowing for arbitrary command execution as the AzuraCast/Liquidsoap process user.

It is recommended to restructure the code to avoid using '/bin/sh -c' for command execution. Instead, use Liquidsoap's array-form process option or an execve operator that accepts an explicit argument list. Additionally, shell-escape user-controlled inputs with escapeshellarg() before concatenation, and implement validation to reject shell metacharacters at the setter level for the affected StereoTool configuration fields.