CVE-2026-50179 Details
Description
Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.
A vulnerability exists in Actual Budget, a local-first personal finance tool, in versions prior to 26.6.0. The issue arises in the CSV export functionality, where user-controlled strings for Payee, Notes, Account, and Category are passed to the csv-stringify library without proper sanitization. Strings beginning with certain characters, including equals sign, plus, minus, at sign, tab, or carriage return, are exported verbatim. When the CSV file is opened in spreadsheet applications like Excel, LibreOffice Calc, or Google Sheets, these strings are interpreted as formulas. This flaw allows for exfiltration of transaction data by exploiting the formula evaluation feature of these applications.
Users can update to Actual Budget version 26.6.0 or later, where this vulnerability has been fixed. Additionally, it is recommended to strip or neutralize formula prefixes on import to prevent such strings from being saved in the database.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306 | [email protected] | Source CodeVendor |
| https://github.com/actualbudget/actual/releases/tag/v26.6.0 | [email protected] | Release NotesVendor |
| https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Actual | <= 26.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |