Executive brief
Actual is a personal finance application. A vulnerability in its command-line interface and export tools allows malicious data (such as specially crafted transaction notes or payee names) to be interpreted as executable formulas when exported to a CSV file. If a user opens one of these exported files in spreadsheet software like Excel or Google Sheets, it could lead to unauthorized data access or the execution of malicious commands on the user's computer.
Technical details
The vulnerability is a CSV Formula Injection (CWE-1236) residing in the hand-rolled `escapeCsv` helper within `packages/cli/src/output.ts` and the transaction export logic. The serializer only handled RFC 4180 escaping (delimiters, quotes, and newlines) but failed to neutralize prefixes such as `=`, `+`, `-`, `@`, tab, or carriage returns. An attacker with the ability to input strings into the application (e.g., via transaction notes, category names, or payee lists) can inject malicious formulas. When a user exports this data using the `--format csv` CLI option or the transaction export feature and opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, the spreadsheet software may execute the formulas, leading to data exfiltration or local command execution. The issue is fixed in version 26.6.0 by prefixing suspicious cells with a single quote.
Affected products
- actualbudget actual-app/cli < 26.6.0
- actualbudget actual < 26.6.0
Timeline
- 2026-05-16: patched: Fix committed to master branch
- 2026-06-01: advisory: Release v26.6.0 published
- 2026-07-07: disclosed: CVE-2026-46672 published