AzuraCast versions prior to 0.23.6 contain a code injection vulnerability in the remote relay password field. This arises from incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can exploit this to inject nested Liquidsoap interpolation syntax, enabling arbitrary code execution within the Liquidsoap process, disclosure of internal API keys, or disruption of station operations.