CVE-2026-121433
Deferred Deferred - Pending Action

Stored CSV Formula Injection in AzuraCast Prior to 0.24.0

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121433
EUVD
EUVD-2026-115855

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AzuraCast AzuraCast 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

AzuraCast before version 0.24.0 has a stored CSV formula injection vulnerability. Station users with Media permissions can inject formula-prefixed metadata (like titles or artists) during bulk media imports. When exported CSVs are opened in spreadsheets, these formulas execute, potentially causing unauthorized actions or misleading data display.

Detection Guidance

Monitor for suspicious metadata in bulk media imports. Check CSV exports for formula prefixes like =, +, -, or @ in titles, artists, or custom fields. Review API logs for /api/station/{station_id}/files/bulk requests with unusual payloads.

Impact Analysis

If you use AzuraCast versions before 0.24.0, an attacker with Media permissions could inject malicious formulas into media metadata. When you export and open these CSVs in spreadsheets, formulas may execute, leading to incorrect calculations, misleading data, or exposure of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or manipulation, potentially violating GDPR (data integrity) or HIPAA (confidentiality). Spreadsheet formula execution might expose sensitive user data or alter records, creating compliance risks if exploited.

Mitigation Strategies

Upgrade AzuraCast to version 0.24.0 or later. Restrict Media permissions to trusted users. Implement input validation to block formula characters in metadata fields. Review and sanitize existing CSV exports before sharing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121433. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...