Executive brief
Actual is an open-source personal finance application. A security flaw in the macOS version allows an attacker with local access to run malicious code that appears to be officially signed by the application. This could allow an attacker to bypass macOS security protections to access sensitive data, such as financial records, keychain passwords, or network resources, while masquerading as a trusted program.
Technical details
The macOS desktop version of Actual (v25.x) fails to disable the 'ELECTRON_RUN_AS_NODE' fuse in its Electron build (v39.2.7). This allows a local attacker to execute the signed application binary with the 'ELECTRON_RUN_AS_NODE=1' environment variable, effectively turning the application into a Node.js REPL. Arbitrary code executed this way inherits the application's code signature and entitlements (such as network and file access), bypassing macOS Gatekeeper and other security reviews. The vulnerability is patched in version 26.5.0.
Affected products
- Actual Budget Actual macOS Desktop Application 25.x
Timeline
- 2026-05-03: patched: Version 26.5.0 released
- 2026-06-05: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD