CVE-2026-50179
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Actual prior to 26.6.0, CSV export functions do not neutralize formula prefixes, allowing injection of malicious formulas (e.g., starting with =, +, -) into CSV files. When opened in Excel, LibreOffice Calc, or Google Sheets, these formulas execute, enabling transaction data exfiltration and manipulation of displayed values.
Risk Assessment
An attacker can inject formulas into exported financial data that, when opened by a victim in a spreadsheet, may exfiltrate sensitive transaction data or alter the spreadsheet appearance, posing a risk to data confidentiality and integrity.
Recommendation
Immediately update Actual to version 26.6.0 or later, which includes a fix neutralizing formula prefixes in CSV export.
Original NVD description (English source)
Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.