CVE-2026-121433 in AzuraCast
Summary
by MITRE • 11/03/2026
AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in AzuraCast versions prior to 0.24.0 represents a significant security risk rooted in the application's handling of user-supplied data during bulk media imports. This flaw is classified as a Stored Cross-Site Scripting variant, specifically known as CSV Formula Injection or Cell Injection. The core technical issue arises from the lack of input sanitization when processing metadata fields such as titles, artists, and custom attributes through the /api/station/{station_id}/files/bulk endpoint. When station users possessing Media permissions upload a CSV file containing entries that begin with specific characters like equals signs, plus signs, minus signs, or tabs, these inputs are stored directly in the database without validation. Consequently, when an administrator or another user exports this data to a CSV format and opens it using spreadsheet software such as Microsoft Excel or LibreOffice Calc, the application interprets the prefixed content not as literal text but as executable formulas. This behavior allows for the execution of arbitrary commands within the context of the spreadsheet client, which can lead to various malicious outcomes including data exfiltration via external HTTP requests, denial of service through resource-intensive calculations, or even remote code execution depending on the capabilities and configuration of the target office suite.
From a technical perspective, this vulnerability exploits the default behavior of modern spreadsheet applications that automatically parse strings starting with formula delimiters as executable expressions rather than plain text data. The attacker leverages the stored nature of the injection by persisting malicious payloads in the application's database through legitimate administrative functions. This persistence ensures that any subsequent user who accesses or exports the compromised media metadata becomes a victim, effectively turning routine operational tasks into vectors for attack. The impact extends beyond simple script execution; it compromises the integrity and confidentiality of station data. Attackers can harvest sensitive information such as API keys, internal IP addresses, or personal details embedded in custom fields by crafting formulas that send this data to an external server controlled by the attacker. Furthermore, the ability to execute complex calculations can lead to denial-of-service conditions within the victim's local environment due to excessive CPU and memory consumption caused by recursive formula evaluation or large-scale data manipulation operations.
This vulnerability aligns with Common Weakness Enumeration (CWE) standards, primarily falling under CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, specifically within the context of CSV parsing and spreadsheet generation. It also relates to CWE-91 XML Injection if underlying data structures are involved, but more accurately maps to CWE-20 Poor Input Validation where user input is not adequately sanitized before storage or processing. In terms of the MITRE ATT&CK framework, this attack vector corresponds to Tactic TA0003 Persistence and Technique T1567 Exploit Public-Facing Application, as it involves leveraging a web application interface to establish persistent access through stored data manipulation. The specific method of using spreadsheet formulas for malicious purposes is often categorized under social engineering or client-side attacks because the actual execution occurs on the victim's machine rather than the server itself, although the initial foothold is gained via the server-side storage mechanism.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade AzuraCast to version 0.24.0 or later, where this vulnerability has been patched by implementing strict input validation and output encoding mechanisms for all CSV-related operations. For environments that cannot immediately patch, administrators should enforce role-based access controls to restrict bulk media import capabilities only to trusted users with verified identities. Additionally, implementing server-side sanitization that escapes or quotes special characters like equals signs in metadata fields before database storage can prevent the injection of formula prefixes. It is also advisable to configure spreadsheet software settings where possible to disable automatic formula evaluation for imported data, although this relies on client-side configuration which may not be feasible for all users. Regular security audits and code reviews focusing on input validation patterns are essential to identify similar weaknesses in other parts of the application that handle user-generated content destined for external consumption formats like CSV or XML.