CVE-2026-50179
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Actual prior to 26.6.0, CSV export functions do not neutralize formula prefixes, allowing injection of malicious formulas (e.g., starting with =, +, -) into CSV files. When opened in Excel, LibreOffice Calc, or Google Sheets, these formulas execute, enabling transaction data exfiltration and manipulation of displayed values.
Risk Assessment
An attacker can inject formulas into exported financial data that, when opened by a victim in a spreadsheet, may exfiltrate sensitive transaction data or alter the spreadsheet appearance, posing a risk to data confidentiality and integrity.
Recommendation
Immediately update Actual to version 26.6.0 or later, which includes a fix neutralizing formula prefixes in CSV export.
Other vulnerabilities in Actual
See all- CVE-2026-57449High
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUAL_GITHUB_TOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw startsWith() prefix test for /repos/{owner}/{repo} without requiring a path boundary after the repository name. If an allowlisted public plugin repository is https://github.com/acme/plugin, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with /repos/acme/plugin. The proxy then forwards the request with the server's ACTUAL_GITHUB_TOKEN, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.
- CVE-2026-49229High
In Actual app in OpenID multi-user mode, disabling a user only blocks future OpenID login, but existing session tokens remain valid. The session validation does not check if the user is still enabled, allowing a disabled user to continue accessing authenticated endpoints.
- CVE-2026-50007High
In Actual up to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call endpoints like /delete-user-file, /reset-user-file, and /user-create-key because requireFileAccess treats ordinary shared access as sufficient for these operations.
Original NVD description (English source)
Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS