AzuraCast

An improper access control vulnerability in AzuraCast allows low-privileged users to inject arbitrary commands into Liquidsoap configurations, leading to remote code execution upon backend restart.

AzuraCast is vulnerable to a Liquidsoap code injection vulnerability due to the incomplete migration from `cleanUpString()` to `toRawString()` in the remote relay password field, allowing a user with the `RemoteRelays` station permission to inject arbitrary Liquidsoap code by exploiting nested interpolation syntax, leading to arbitrary code execution, API key disclosure, and station disruption.