actualbudget Actual up to 26.5.x CSV Export export-to-csv.ts exportToCSV/exportQueryToCSV Payee/Notes/Account/Category neutralization

Summaryinfo

A vulnerability classified as problematic was found in actualbudget Actual up to 26.5.x. The affected element is the function exportToCSV/exportQueryToCSV of the file packages/loot-core/src/server/transactions/export/export-to-csv.ts of the component CSV Export Handler. Such manipulation of the argument Payee/Notes/Account/Category leads to neutralization. This vulnerability is uniquely identified as CVE-2026-50179. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in actualbudget Actual up to 26.5.x. It has been rated as problematic. Affected by this issue is the function exportToCSV/exportQueryToCSV of the file packages/loot-core/src/server/transactions/export/export-to-csv.ts of the component CSV Export Handler. The manipulation of the argument Payee/Notes/Account/Category with an unknown input leads to a neutralization vulnerability. Using CWE to declare the problem leads to CWE-707. The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-50179 since 06/04/2026. The exploitation is known to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 26.6.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• actualbudget

Name

• Actual

Version

• 26.0
• 26.1
• 26.2
• 26.3
• 26.4
• 26.5

Website

• Product: https://github.com/actualbudget/actual/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion