What is GHSA-69c2-7h9f-h4x5?

GHSA-69c2-7h9f-h4x5 is a security advisory published by GitHub Security Advisories with Medium severity. AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station...

Which CVE IDs does GHSA-69c2-7h9f-h4x5 cover?

GHSA-69c2-7h9f-h4x5 covers the following CVE IDs: CVE-2026-121433. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-69c2-7h9f-h4x5?

GHSA-69c2-7h9f-h4x5 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-69c2-7h9f-h4x5MediumCVSS 5.4

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station...

Vendor

GitHub Security Advisories

Published

November 3, 2026

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-121433 →

📋 Description

AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media permission to persist formula-prefixed metadata via bulk media import. Attackers can import crafted titles, artists, or custom fields through /api/station/{station_id}/files/bulk so formulas evaluate when other users open exported CSVs in spreadsheets.

🔗 References (4)

https://github.com/AzuraCast/AzuraCast/security/advisories/GHSA-5x35-83gj-w8gw
https://nvd.nist.gov/vuln/detail/CVE-2026-121433
https://www.vulncheck.com/advisories/azuracast-before-0.24.0-stored-csv-formula-injection-via-bulk-media-export
https://github.com/advisories/GHSA-69c2-7h9f-h4x5