CVE-2026-46672 Details
Description
Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-controlled strings, including transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query, can emit cells that auto-evaluate when the resulting CSV is opened in Excel, LibreOffice Calc, or Google Sheets, enabling data exfiltration and arbitrary formula execution. This issue is fixed in version 26.6.0.
A vulnerability exists in the '@actual-app/cli' component of the Actual personal finance application, prior to version 26.6.0. The issue arises from a custom CSV serializer that fails to properly neutralize formula-injection prefixes, allowing for data exfiltration and arbitrary formula execution when the CSV is opened in spreadsheet programs like Excel, LibreOffice Calc, or Google Sheets. This vulnerability can be exploited through various CLI commands that handle user-controlled string data, such as transaction or account lists.
Users can update to Actual version 26.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306 | [email protected] | Source CodeVendor |
| https://github.com/actualbudget/actual/pull/7859 | [email protected] | Issue TrackingVendor |
| https://github.com/actualbudget/actual/releases/tag/v26.6.0 | [email protected] | Release NotesVendor |
| https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Actual | <= 26.5.2 (semver) |
CPE
Remediation
| |
| Actual CLI | <= 26.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |