AzuraCast versions prior to 0.23.6 contain a vulnerability in the sanitization of the remote relay password field in Liquidsoap configuration. The method cleanUpString() intended to strip Liquidsoap interpolation patterns can be bypassed using nested interpolation syntax, allowing an attacker with RemoteRelays station permission to inject arbitrary Liquidsoap code. This can lead to arbitrary code execution within the Liquidsoap process, disclosure of internal API keys, and disruption of station operation. The vulnerability arises because the password field was not migrated to the safer toRawString() method, which prevents interpolation. A patch is available in version 0.23.6 that fixes this issue.