CVE-2026-121433

The record

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.

Affected packages

Related vulnerabilities

• CVE-2026-116648 Tanium addressed an improper output sanitization vulnerability in Discover. CWE-1236
• CVE-2026-67187 Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side… CWE-1236
• CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations export in… CWE-1236
• CVE-2026-116647 Tanium addressed an improper output sanitization vulnerability in Comply. CWE-1236
• CVE-2026-116649 Tanium addressed an improper output sanitization vulnerability in Enforce. CWE-1236
• CVE-2026-86020 Part-DB is an open source inventory management system for electronic components. CWE-1236
• CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV… CWE-1236
• CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV… CWE-1236