{"id":"EUVD-2026-36547","enisaUuid":"7a5cc09b-cf94-3fe1-b4bf-8ed6dd306ac5","description":"Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary with the ELECTRON_RUN_AS_NODE\u003d1 environment variable set. This converts the application into a Node.js REPL capable of executing arbitrary code that inherits the application\u0027s entitlements and code signature, bypassing macOS Gatekeeper review. Version 26.5.0 patches the issue.","datePublished":"Jun 12, 2026, 6:58:42 PM","dateUpdated":"Jun 12, 2026, 8:04:10 PM","baseScore":4.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-7rvm-xjpp-63r9\nhttps://actualbudget.org/blog/release-26.5.0\n","aliases":"CVE-2026-42890\nGHSA-7rvm-xjpp-63r9\n","assigner":"GitHub_M","epss":0.13,"enisaIdProduct":[{"id":"693644b5-8d7a-3caf-8d2e-85a29befa60a","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.5.0"}],"enisaIdVendor":[{"id":"1cc0cb9f-3e5b-3241-9502-fc20096d7227","vendor":{"name":"actualbudget"}}],"enisaIdVulnerability":[{"id":"78cc095e-07c9-3e62-8c0b-ec5f1a82cd87","vulnerability":{"id":"GHSA-7rvm-xjpp-63r9","description":"actual Allows Electron to Run As Node","datePublished":"Jun 8, 2026, 6:21:26 PM","dateUpdated":"Jun 12, 2026, 9:59:55 PM","baseScore":0.0,"references":"https://github.com/actualbudget/actual/security/advisories/GHSA-7rvm-xjpp-63r9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42890\nhttps://actualbudget.org/blog/release-26.5.0\nhttps://github.com/actualbudget/actual\n","enisa_id":"EUVD-2026-36547\n","aliases":"CVE-2026-42890\nGHSA-7rvm-xjpp-63r9\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8f345baf-40d8-3cfa-ad82-64297575c5fd","vulnerability":{"id":"CVE-2026-42890","description":"Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary with the ELECTRON_RUN_AS_NODE\u003d1 environment variable set. This converts the application into a Node.js REPL capable of executing arbitrary code that inherits the application\u0027s entitlements and code signature, bypassing macOS Gatekeeper review. Version 26.5.0 patches the issue.","datePublished":"Jun 12, 2026, 6:58:42 PM","dateUpdated":"Jun 12, 2026, 8:04:10 PM","status":"PUBLISHED","baseScore":4.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-7rvm-xjpp-63r9\nhttps://actualbudget.org/blog/release-26.5.0\n","enisa_id":"EUVD-2026-36547\n","assigner":"GitHub_M","epss":0.13,"dataProcessed":"Oct 30, 2026, 7:17:05 AM","vulnerabilityProduct":[{"id":"f585c29f-fde3-34e0-97a0-b98081c26e47","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.5.0"}],"vulnerabilityVendor":[{"id":"a3324a22-095c-3ef8-8cad-d9a21967e281","vendor":{"name":"actualbudget"}}]}}],"enisaIdAdvisory":[]}