---
id: "CVE-2026-121433"
kind: "vulnerability"
aliases: ["CVE-2026-121433"]
title: "AzuraCast: stored CSV formula injection via bulk media import"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["azuracast", "other", "radio", "self-hosted"]
not_affected_if: ["no-media-permission-users", "version-0.24.0-or-later"]
published_at: "2026-11-03T15:17:34+00:00"
first_seen_at: "2026-11-03T15:22:00+00:00"
updated_at: "2026-11-03T15:23:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121433", "first_seen_at": "2026-11-03T15:22:00+00:00"}]
---

# AzuraCast: stored CSV formula injection via bulk media import

AzuraCast before 0.24.0 lets a station user with Media permission save spreadsheet formulas in media titles, artists, or custom fields through the bulk import API. When another user exports the metadata to CSV and opens it in a spreadsheet, those formulas can run on that person's computer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the AzuraCast version; the sources say versions before `0.24.0` are affected.
- Review which users hold the Media permission on each station.
- Look for formula-prefixed values (starting with `=`, `+`, `-`, or `@`) in media metadata.

## Fix

- AzuraCast: upgrade to `0.24.0` or later.

## Timeline

- 2026-11-03T15:22:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121433

## Documents

- [advisory] Vendor advisory: github.com https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/azuracast-before-0.24.0-stored-csv-formula-injection-via-bulk-media-export

## From the sources

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_