{"id":"EUVD-2026-42079","enisaUuid":"eb007a8d-657d-35bf-a976-2a477bff77ef","description":"Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-controlled strings, including transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query, can emit cells that auto-evaluate when the resulting CSV is opened in Excel, LibreOffice Calc, or Google Sheets, enabling data exfiltration and arbitrary formula execution. This issue is fixed in version 26.6.0.","datePublished":"Jul 7, 2026, 8:55:02 PM","dateUpdated":"Jul 8, 2026, 1:00:02 PM","baseScore":4.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq\nhttps://github.com/actualbudget/actual/pull/7859\nhttps://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306\nhttps://github.com/actualbudget/actual/releases/tag/v26.6.0\n","aliases":"CVE-2026-46672\nGHSA-7gh7-258j-4mpq\n","assigner":"GitHub_M","epss":0.18,"enisaIdProduct":[{"id":"9639f9be-1dd3-3c5d-bb8c-08db76801fc4","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.6.0"}],"enisaIdVendor":[{"id":"5935f852-ce02-30ca-8da6-bba3a6007e20","vendor":{"name":"actualbudget"}}],"enisaIdVulnerability":[{"id":"6d614b17-2958-379a-aaff-7321bbcef125","vulnerability":{"id":"CVE-2026-46672","description":"Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-controlled strings, including transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query, can emit cells that auto-evaluate when the resulting CSV is opened in Excel, LibreOffice Calc, or Google Sheets, enabling data exfiltration and arbitrary formula execution. This issue is fixed in version 26.6.0.","datePublished":"Jul 7, 2026, 8:55:02 PM","dateUpdated":"Jul 8, 2026, 1:00:02 PM","status":"PUBLISHED","baseScore":4.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq\nhttps://github.com/actualbudget/actual/pull/7859\nhttps://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306\nhttps://github.com/actualbudget/actual/releases/tag/v26.6.0\n","enisa_id":"EUVD-2026-42079\n","assigner":"GitHub_M","epss":0.18,"dataProcessed":"Nov 3, 2026, 7:18:25 AM","vulnerabilityProduct":[{"id":"7e36da50-ed01-3f78-9a65-513109aead53","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.6.0"}],"vulnerabilityVendor":[{"id":"2f3d928e-add8-3f6e-af15-4ecfacf1ad86","vendor":{"name":"actualbudget"}}]}},{"id":"b6bbb00d-2888-3f56-a739-90337ef9f866","vulnerability":{"id":"GHSA-7gh7-258j-4mpq","description":"@actual-app/cli `--format csv` Output Vulnerable to CSV Formula Injection via Custom `escapeCsv` Helper","datePublished":"Jun 22, 2026, 9:42:15 PM","dateUpdated":"Jun 22, 2026, 9:42:15 PM","baseScore":0.0,"references":"https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq\nhttps://github.com/actualbudget/actual\n","enisa_id":"EUVD-2026-42079\n","aliases":"CVE-2026-46672\nGHSA-7gh7-258j-4mpq\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}