vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-50179

Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

MEDIUM
4.2
CVSS Score
Published: July 7, 2026 at 08:58 PM UTC
Updated: October 25, 2026 at 08:10 PM UTC
1 product affected across 1 vendorActual

Using actual by actualbudget?

Get instant alerts when new vulnerabilities affect actual - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.2
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Actual· Actualbudgetnpm
90%
v < 26.6.0
Affected range stops below 26.6.0, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (3)

x_refsource_CONFIRM
Source: cverecord
https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm
x_refsource_MISC
Source: cverecord
https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306
x_refsource_MISC
Source: cverecord
https://github.com/actualbudget/actual/releases/tag/v26.6.0

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.2MEDIUMGitHub_M
Attack Vector
NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-1236

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card