CVE-2026-42890 Details
Description
Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary with the ELECTRON_RUN_AS_NODE=1 environment variable set. This converts the application into a Node.js REPL capable of executing arbitrary code that inherits the application's entitlements and code signature, bypassing macOS Gatekeeper review. Version 26.5.0 patches the issue.
A vulnerability in the Actual personal finance application for macOS has been identified in version 25.x, which is built on Electron 39.2.7. The issue arises because the ELECTRON_RUN_AS_NODE fuse is not disabled, enabling an attacker who can manipulate command-line arguments or place a file on disk to execute arbitrary Node.js code. This code execution occurs within a Node.js REPL environment, inheriting the application's entitlements and code signature, and bypasses macOS Gatekeeper review. As a result, the executed code runs as the Actual application, with access to various system resources such as network, file, keychain, and automation capabilities. This vulnerability has been patched in version 26.5.0.
Users can update to Actual version 26.5.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 12, 2026CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://actualbudget.org/blog/release-26.5.0 | [email protected] | Release NotesVendor |
| https://github.com/actualbudget/actual/security/advisories/GHSA-7rvm-xjpp-63r9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Actual | < 26.5.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |