CVE-2026-50179

Name of the Vulnerable Software and Affected Versions Actual versions prior to 26.6.0

Description Actual is a local-first personal finance tool that fails to neutralize formula-trigger characters when exporting data to CSV. The functions exportToCSV() and exportQueryToCSV() in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled strings from the Payee, Notes, Account, and Category variables to the csv-stringify library without a cast callback. Consequently, strings starting with =, +, -, @, tab, or carriage return are written verbatim into the CSV file.

When a user opens the exported file in spreadsheet software such as Microsoft Excel, LibreOffice Calc, or Google Sheets, these strings are interpreted as formulas. This can lead to the exfiltration of sensitive transaction data (such as amounts, account names, and balances) to an attacker-controlled URL via functions like =HYPERLINK, =WEBSERVICE, or =IMPORTXML. Additionally, it allows attackers to manipulate displayed values in the spreadsheet or potentially achieve remote code execution on older versions of Excel through Dynamic Data Exchange (DDE).

Recommendations Update Actual to version 26.6.0. As a temporary mitigation, avoid importing files from untrusted sources and restrict the use of the CSV export feature until the update is applied.