TI-2026-31096 Aliases CVE-2026-42890 GHSA-7rvm-xjpp-63r9

actual Allows Electron to Run As Node

LOW 21CWE-94Published 2026-06-12 · Updated 2026-06-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution, Privilege escalation, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94, CWE-250 and CWE-693.

Summary

Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary with the ELECTRON_RUN_AS_NODE=1 environment variable set. This converts the application into a Node.js REPL capable of executing arbitrary code that inherits the application's entitlements and code signature, bypassing macOS Gatekeeper review. Version 26.5.0 patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00126 2nd percentileScored 2026-11-07

Fix Fixed actual (actualbudget): 26.5.0actual (npm): 26.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
actualbudget	actual	before 26.5.0	26.5.0	Patch available	CNA
—	actual (npm)	before 26.5.0	26.5.0	Patch available	GHSA-7rvm-xjpp-63r9

actual Vendoractualbudget Affected before 26.5.0 Fixed in 26.5.0 Patch available CNA
actual (npm) Vendor— Affected before 26.5.0 Fixed in 26.5.0 Patch available GHSA-7rvm-xjpp-63r9

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:actualbudget:actual::::::::	—	—	actualbudget

cpe:2.3:a:actualbudget:actual:*:*:*:*:*:*:*:* Versions — — ·actualbudget

Remediation

Fix · CNA actual (actualbudget) Fixed in 26.5.0
Fix · GHSA-7rvm-xjpp-63r9 actual (npm) Fixed in 26.5.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-42890
2026-10-03 Alias added: GHSA-7rvm-xjpp-63r9

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-42890

Other 3

TI-2026-21972 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints CVSS 4.0CRITICAL 9.2
TI-2026-25729 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers CVSS 3.1HIGH 8.8
TI-2026-36430 Actual: Disabled OpenID users keep access through existing session tokens CVSS 3.1HIGH 8.3
TI-2026-36833 Actual: Shared users can perform owner-only file management actions CVSS 4.0HIGH 7.2
TI-2026-22020 ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode CVSS 4.0MEDIUM 5.7
TI-2026-41382 Information disclosure in actualbudget actual CVSS 4.0HIGH 7.1

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences