AzuraCast versions through 0.23.x have a command injection vulnerability in the Liquidsoap configuration generation for live recording. The vulnerability arises because the streamer username is not properly quoted in process.run calls, allowing authenticated station users with Streamers and Profile permissions to execute arbitrary commands as the Liquidsoap process user when recording ends.