{"id":"CVE-2026-121433","published":"2026-11-03T15:17:34.437","lastModified":"2026-11-03T17:18:09.527","description":"AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwes":["CWE-1236"],"vendors":[],"products":[],"references":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","tags":[]},{"url":"https://www.vulncheck.com/advisories/azuracast-before-0.24.0-stored-csv-formula-injection-via-bulk-media-export","tags":[]},{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","tags":[]}],"exploitRefs":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","tags":[]},{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","tags":[]}],"hasPoc":true,"ai":null}