Live › vulnerability › CVE-2026-121433
AzuraCast before 0.24.0 lets a station user with Media permission save spreadsheet formulas in media titles, artists, or custom fields through the bulk import API. When another user exports the metadata to CSV and opens it in a spreadsheet, those formulas can run on that person's computer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Teams that run AzuraCast for radio stations and let users with Media permission import files in bulk. The risk lands on whoever opens exported CSV files in a spreadsheet program. Installs on 0.24.0 or later, or that never grant Media permission to untrusted users, are less exposed.
No product ranges from the sources yet.
0.24.0 are affected.=, +, -, or @) in media metadata.0.24.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.
This page as .md · .json · in your agent: get_signal("CVE-2026-121433")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.