{"id":"EUVD-2026-42104","enisaUuid":"5e638610-06f3-3025-8e2e-e6d2905e7a9a","description":"Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.","datePublished":"Jul 7, 2026, 8:58:16 PM","dateUpdated":"Jul 9, 2026, 2:42:17 PM","baseScore":4.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm\nhttps://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306\nhttps://github.com/actualbudget/actual/releases/tag/v26.6.0\n","aliases":"CVE-2026-50179\nGHSA-xqjm-27pc-rvwm\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"dbf0e44a-add6-398c-9395-5ef8830bef2e","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.6.0"}],"enisaIdVendor":[{"id":"ca9914d1-f2dd-32bb-b07f-0aac51a3e2f1","vendor":{"name":"actualbudget"}}],"enisaIdVulnerability":[{"id":"323417c5-0a6e-30fd-8189-640e2fa1788e","vulnerability":{"id":"GHSA-xqjm-27pc-rvwm","description":"@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields","datePublished":"Jun 22, 2026, 11:48:40 PM","dateUpdated":"Jun 22, 2026, 11:48:40 PM","baseScore":0.0,"references":"https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm\nhttps://github.com/actualbudget/actual\n","enisa_id":"EUVD-2026-42104\n","aliases":"CVE-2026-50179\nGHSA-xqjm-27pc-rvwm\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c2a2b190-79ed-3171-bd64-c447fafc525d","vulnerability":{"id":"CVE-2026-50179","description":"Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.","datePublished":"Jul 7, 2026, 8:58:16 PM","dateUpdated":"Jul 9, 2026, 2:42:17 PM","status":"PUBLISHED","baseScore":4.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","references":"https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm\nhttps://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306\nhttps://github.com/actualbudget/actual/releases/tag/v26.6.0\n","enisa_id":"EUVD-2026-42104\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 5, 2026, 7:15:46 AM","vulnerabilityProduct":[{"id":"c87c8740-ae03-3afa-8346-e94f435aefd3","product":{"name":"actual","vendor":{"name":"actualbudget"}},"product_version":"\u003c 26.6.0"}],"vulnerabilityVendor":[{"id":"e58de4a2-187b-3185-bf83-a41ba738a27e","vendor":{"name":"actualbudget"}}]}}],"enisaIdAdvisory":[]}