{"id":"CVE-2026-121429","published":"2026-11-03T15:17:33.747","lastModified":"2026-11-03T17:18:09.393","description":"AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx","tags":[]},{"url":"https://www.vulncheck.com/advisories/azuracast-through-0.23.8-command-injection-via-stereotool-liquidsoap-pipe","tags":[]},{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx","tags":[]}],"exploitRefs":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx","tags":[]},{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx","tags":[]}],"hasPoc":true,"ai":{"summary":"AzuraCast through 0.23.8 allows station users with Profile permission to inject and execute arbitrary OS commands via StereoTool settings (stereo_tool_configuration_path or stereo_tool_license_key) during station restart, as the values are passed unescaped to /bin/sh, leading to container compromise.","exploitability":"Exploitation requires valid station user credentials with Profile permission and knowledge of which fields accept user-controlled input; no special privileges beyond that are needed.","blast_radius":"Successful exploitation grants full OS-level access inside the AzuraCast container, enabling data theft, lateral movement, or service disruption across the host and potentially other containers sharing resources.","remediation":"Upgrade to AzuraCast version 0.23.9 or later, which patches the command injection in StereoTool configuration handling.","detection":"Defenders should monitor for unexpected /bin/sh invocations during station restart events in container logs, especially those triggered by non-root users with Profile permissions, and inspect logs for abnormal process spawning patterns from the web application context.","tags":["command-injection","container-breakout","webapp","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-04T09:57:27.283Z"}}