Actual up to 26.5.x CSV Serializer output.ts escapeCsv deserialization

Summaryinfo

A vulnerability was found in Actual up to 26.5.x. It has been rated as problematic. The impacted element is the function escapeCsv of the file packages/cli/src/output.ts of the component CSV Serializer. The manipulation leads to deserialization. This vulnerability is documented as CVE-2026-46672. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability was found in Actual up to 26.5.x and classified as problematic. This issue affects the function escapeCsv of the file packages/cli/src/output.ts of the component CSV Serializer. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-controlled strings, including transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query, can emit cells that auto-evaluate when the resulting CSV is opened in Excel, LibreOffice Calc, or Google Sheets, enabling data exfiltration and arbitrary formula execution. This issue is fixed in version 26.6.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-46672 since 05/15/2026. The exploitation is known to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 26.6.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Actual

Version

• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion