{"id":"EUVD-2026-36547","revision":"a520327b8b824f5f83982946a7bdae5e","records":[{"revision":"a520327b8b824f5f83982946a7bdae5e","observedAt":"2026-11-03T08:08:56.54+00:00","statement":{"source":"euvd","id":"EUVD-2026-36547","aliases":["CVE-2026-42890","GHSA-7rvm-xjpp-63r9"],"title":"Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control com…","description":"Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary with the ELECTRON_RUN_AS_NODE=1 environment variable set. This converts the application into a Node.js REPL capable of executing arbitrary code that inherits the application's entitlements and code signature, bypassing macOS Gatekeeper review. Version 26.5.0 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":4.8,"severity":null}],"references":["https://github.com/actualbudget/actual/security/advisories/GHSA-7rvm-xjpp-63r9","https://actualbudget.org/blog/release-26.5.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-36547","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 12, 2026, 6:58:42 PM","dateUpdated":"Jun 12, 2026, 8:04:10 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-36547","identifiers":["EUVD-2026-36547","CVE-2026-42890","GHSA-7rvm-xjpp-63r9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}