AzuraCast versions prior to 0.23.4 have a code injection vulnerability in the ConfigWriter::cleanUpString() method. This flaw allows authenticated users with Media or Profile permissions to inject arbitrary Liquidsoap code via unsanitized string interpolation sequences. Exploitation can lead to execution of shell commands as the azuracast user when the station restarts.