Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-controlled strings, including transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query, can emit cells that auto-evaluate when the resulting CSV is opened in Excel, LibreOffice Calc, or Google Sheets, enabling data exfiltration and arbitrary formula execution. This issue is fixed in version 26.6.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| actualbudget | actual | before 26.6.0 | 26.6.0 | Patch available | CNA |
| — | @actual-app/cli (npm) | before 26.6.0 | 26.6.0 | Patch available | GHSA-7gh7-258j-4mpq |
- actual Vendoractualbudget Affected before 26.6.0 Fixed in 26.6.0 Patch available CNA
- @actual-app/cli (npm) Vendor— Affected before 26.6.0 Fixed in 26.6.0 Patch available GHSA-7gh7-258j-4mpq
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:actualbudget:actual:*:*:*:*:*:*:*:* | — | — | actualbudget |
- cpe:2.3:a:actualbudget:actual:*:*:*:*:*:*:*:* Versions — — ·actualbudget
Remediation
- Fix · CNA actual (actualbudget) Fixed in 26.6.0
- Fix · GHSA-7gh7-258j-4mpq @actual-app/cli (npm) Fixed in 26.6.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-46672
- 2026-10-03 Alias added: GHSA-7gh7-258j-4mpq
References
Other 5
- https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq
- https://github.com/actualbudget/actual/pull/7859
- https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306
- https://github.com/actualbudget/actual/releases/tag/v26.6.0
- https://github.com/actualbudget/actual
More actualbudget vulnerabilities
- TI-2026-21972 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints CVSS 4.0CRITICAL 9.2
- TI-2026-25729 Actual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers CVSS 3.1HIGH 8.8
- TI-2026-36430 Actual: Disabled OpenID users keep access through existing session tokens CVSS 3.1HIGH 8.3
- TI-2026-36833 Actual: Shared users can perform owner-only file management actions CVSS 4.0HIGH 7.2
- TI-2026-22020 ActualBudget missing authorization in sync endpoints allows cross-user budget file access in multi-user mode CVSS 4.0MEDIUM 5.7
- TI-2026-41382 Information disclosure in actualbudget actual CVSS 4.0HIGH 7.1
Sources
- CVE-2026-46672 · CVE Program
- CVE-2026-46672 · NVD
- FIRST EPSS
- GHSA-7gh7-258j-4mpq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences