{"id":"CVE-2026-121433","aliases":[],"cve":{"records":[{"id":"CVE-2026-121433","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-03T12:30:48.366Z","published":"2026-11-03T14:28:26.431Z","modified":"2026-11-03T17:00:53.992Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-03T14:28:26.431Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-03T17:00:53.992Z"}],"references":[{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/azuracast-before-0.24.0-stored-csv-formula-injection-via-bulk-media-export","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-1236","description":"Improper Neutralization of Formula Elements in a CSV File","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:azuracast:azuracast:*:*:*:*:*:*:*:*","versionEndExcluding":"0.24.0"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-03T16:59:47.575721Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"AzuraCast before 0.24.0 Stored CSV Formula Injection via Bulk Media Export","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.","score":5.4,"severity":"medium","published":"2026-11-03T14:28:26.431Z","modified":"2026-11-03T17:00:53.992Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"AzuraCast","name":"AzuraCast","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"0.24.0","versionType":"semver"},{"version":"0.24.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-121433"}],"remediation":[],"references":["https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw","https://www.vulncheck.com/advisories/azuracast-before-0.24.0-stored-csv-formula-injection-via-bulk-media-export"],"sources":[{"name":"CVE","id":"CVE-2026-121433","modified":"2026-11-03T17:00:53.992Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-121433"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.1},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4}],"sourceAffected":[],"observedAt":"2026-11-03T17:16:13.131Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:55:32.844Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"AzuraCast before 0.24.0 has a stored CSV formula injection vulnerability, allowing users with Media permission to inject formulas via bulk media import, which can be executed when others open exported CSVs. Attackers need access to the /api/station/{station_id}/files/bulk endpoint. The impact is unclear.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T14:51:07.493Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-121433"}]}}