HIGH 8.7 NVD
CVE-2026-121429
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool sett
AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.
References
- https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx
- https://www.vulncheck.com/advisories/azuracast-through-0.23.8-command-injection-via-stereo
- https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-c45c-wrcp-22fx
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.