Is CVE-2026-46672 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46672 being exploited in the wild.

How severe is CVE-2026-46672?

Medium severity, with a CVSS score of 4.6, published 7 July 2026.

Which products and versions are affected?

@actual-app/cli (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.

Is there a fix for CVE-2026-46672?

Yes. @actual-app/cli (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46672 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-46672?

Check whether you run Actual Budget Actual CLI or @actual-app/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46672: Actual Budget CSV formula injection in CLI and exports

Q: Is there a fix for CVE-2026-46672?

Yes. @actual-app/cli (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46672 attacked?

It is attacked with local access, in a network appliance.

Q: Am I affected by CVE-2026-46672?

Check whether you run Actual Budget Actual CLI or @actual-app/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46672 · Severity: medium · CVSS 4.6 · Published 2026-07-07

Actual is a personal finance application. A vulnerability in its command-line interface and export tools allows malicious data (such as specially crafted transaction notes or payee names) to be interpreted as executable formulas when exported to a CSV file. If a user opens one of these exported files in spreadsheet software like Excel or Google Sheets, it could lead to unauthorized data access or the execution of malicious commands on the user's computer.

Vendors: Actual Budget, npm.

Quick answers

Is CVE-2026-46672 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46672 being exploited in the wild.
How severe is CVE-2026-46672?: Medium severity, with a CVSS score of 4.6, published 7 July 2026.
Which products and versions are affected?: @actual-app/cli (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.
Is there a fix for CVE-2026-46672?: Yes. @actual-app/cli (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46672 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-46672?: Check whether you run Actual Budget Actual CLI or @actual-app/cli (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@actual-app/cli (npm): upgrade to 26.6.0 or later
```
npm install @actual-app/cli@26.6.0
```

Technical details

The vulnerability is a CSV Formula Injection (CWE-1236) residing in the hand-rolled `escapeCsv` helper within `packages/cli/src/output.ts` and the transaction export logic. The serializer only handled RFC 4180 escaping (delimiters, quotes, and newlines) but failed to neutralize prefixes such as `=`, `+`, `-`, `@`, tab, or carriage returns. An attacker with the ability to input strings into the application (e.g., via transaction notes, category names, or payee lists) can inject malicious formulas. When a user exports this data using the `--format csv` CLI option or the transaction export feature and opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, the spreadsheet software may execute the formulas, leading to data exfiltration or local command execution. The issue is fixed in version 26.6.0 by prefixing suspicious cells with a single quote.

Affected products

actualbudget actual-app/cli < 26.6.0
actualbudget actual < 26.6.0

Identifiers

CVE-2026-46672
GHSA-7gh7-258j-4mpq

Timeline

2026-05-16: patched: Fix committed to master branch
2026-06-01: advisory: Release v26.6.0 published
2026-07-07: disclosed: CVE-2026-46672 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.