Is CVE-2026-50179 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50179 being exploited in the wild.

How severe is CVE-2026-50179?

Medium severity, with a CVSS score of 4.2, published 7 July 2026.

Which products and versions are affected?

Actual Budget < 26.6.0; @actual-app/web (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.

Is there a fix for CVE-2026-50179?

Yes. @actual-app/web (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50179 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50179?

Check whether you run Actual Budget or @actual-app/web (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50179: Actual Budget CSV formula injection in transaction export

Q: Which products and versions are affected?

Actual Budget < 26.6.0; @actual-app/web (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.

Q: Is there a fix for CVE-2026-50179?

Yes. @actual-app/web (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50179 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-50179?

Check whether you run Actual Budget or @actual-app/web (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50179 · Severity: medium · CVSS 4.2 · Published 2026-07-07

Actual Budget, a personal finance and budgeting tool, is vulnerable to a security flaw where malicious data can be hidden within transaction records. If a user imports a specially crafted bank statement or file and later exports their data to a spreadsheet (like Excel or Google Sheets), the malicious data can execute as a formula. This could allow an attacker to trick the user into clicking a link that steals sensitive financial information or displays fraudulent transaction details.

Technologies: Actual Budget. Vendors: Actual Budget, npm.

Quick answers

Is CVE-2026-50179 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50179 being exploited in the wild.
How severe is CVE-2026-50179?: Medium severity, with a CVSS score of 4.2, published 7 July 2026.
Which products and versions are affected?: Actual Budget < 26.6.0; @actual-app/web (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.
Is there a fix for CVE-2026-50179?: Yes. @actual-app/web (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50179 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50179?: Check whether you run Actual Budget or @actual-app/web (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@actual-app/web (npm): upgrade to 26.6.0 or later
```
npm install @actual-app/web@26.6.0
```

Technical details

A CSV injection (Formula Injection) vulnerability exists in Actual Budget's `exportToCSV` and `exportQueryToCSV` functions within `packages/loot-core/src/server/transactions/export/export-to-csv.ts`. The application fails to neutralize formula-triggering characters (=, +, -, @, tab, or carriage return) in user-controlled fields such as Payee, Notes, Account, and Category before passing them to the `csv-stringify` library. An attacker can plant malicious payloads by providing a crafted import file (OFX, QIF, CSV) or via the API. When a victim exports the budget and opens it in Excel, LibreOffice, or Google Sheets, these strings execute as formulas (e.g., `=HYPERLINK`, `=WEBSERVICE`), enabling the exfiltration of adjacent cell data to an attacker-controlled server. The issue is fixed in version 26.6.0 by implementing a `cast.string` callback to prefix such strings with a single quote.

Affected products

actualbudget Actual Budget < 26.6.0

Identifiers

CVE-2026-50179
GHSA-xqjm-27pc-rvwm

Timeline

2026-05-16: patched: Fix committed to repository
2026-06-01: advisory: Version 26.6.0 released
2026-06-12: disclosed: Security advisory published on GitHub
2026-07-07: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.