CVE-2026-46672

Name of the Vulnerable Software and Affected Versions @actual-app/cli versions prior to 26.6.0

Description The @actual-app/cli tool contains a CSV serialization issue in the escapeCsv function within packages/cli/src/output.ts. When the --format csv option is used, the serializer only handles standard RFC 4180 escaping for delimiters, quotes, and newlines, but fails to neutralize formula-injection prefixes such as =, +, -, @, t, and r.

Any CLI command that streams object arrays containing user-controlled strings—including transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query—can emit cells that are automatically evaluated as formulas when opened in spreadsheet software like Excel, LibreOffice Calc, or Google Sheets. This can lead to arbitrary formula execution and data exfiltration of sensitive financial information from adjacent cells using functions like =HYPERLINK(...) or =WEBSERVICE(...).

Recommendations Update @actual-app/cli to version 26.6.0. As a temporary workaround, avoid using the --format csv option when exporting data that may contain untrusted or user-provided strings.