Is CVE-2026-42890 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42890 being exploited in the wild.

How severe is CVE-2026-42890?

Medium severity, with a CVSS score of 4, published 12 June 2026.

Which products and versions are affected?

Actual Budget Actual macOS Desktop Application 25.x; actual (npm) < 26.5.0, SEMVER:introduced=0,fixed=26.5.0.

Is there a fix for CVE-2026-42890?

Yes. actual (npm): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42890 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-42890?

Check whether you run Actual Budget Actual macOS Desktop Application or actual (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42890: Actual Budget macOS desktop application arbitrary code execution via Electron fuse

Q: Is there a fix for CVE-2026-42890?

Yes. actual (npm): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42890 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-42890?

Check whether you run Actual Budget Actual macOS Desktop Application or actual (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42890 · Severity: medium · CVSS 4 · Published 2026-06-12

Actual is an open-source personal finance application. A security flaw in the macOS version allows an attacker with local access to run malicious code that appears to be officially signed by the application. This could allow an attacker to bypass macOS security protections to access sensitive data, such as financial records, keychain passwords, or network resources, while masquerading as a trusted program.

Technologies: actual (npm). Vendors: Actual Budget, npm.

Quick answers

Is CVE-2026-42890 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42890 being exploited in the wild.
How severe is CVE-2026-42890?: Medium severity, with a CVSS score of 4, published 12 June 2026.
Which products and versions are affected?: Actual Budget Actual macOS Desktop Application 25.x; actual (npm) < 26.5.0, SEMVER:introduced=0,fixed=26.5.0.
Is there a fix for CVE-2026-42890?: Yes. actual (npm): upgrade to 26.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42890 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-42890?: Check whether you run Actual Budget Actual macOS Desktop Application or actual (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

actual (npm): upgrade to 26.5.0 or later
```
npm install actual@26.5.0
```

Technical details

The macOS desktop version of Actual (v25.x) fails to disable the 'ELECTRON_RUN_AS_NODE' fuse in its Electron build (v39.2.7). This allows a local attacker to execute the signed application binary with the 'ELECTRON_RUN_AS_NODE=1' environment variable, effectively turning the application into a Node.js REPL. Arbitrary code executed this way inherits the application's code signature and entitlements (such as network and file access), bypassing macOS Gatekeeper and other security reviews. The vulnerability is patched in version 26.5.0.

Affected products

Actual Budget Actual macOS Desktop Application 25.x

Identifiers

CVE-2026-42890
GHSA-7rvm-xjpp-63r9

Timeline

2026-05-03: patched: Version 26.5.0 released
2026-06-05: advisory: GitHub Security Advisory published
2026-06-12: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.