# CVE-2026-50179: Actual Budget CSV formula injection in transaction export

Source: https://junglewise.ai/threats/cve-2026-50179-actual-budget-csv-formula-injection-in-transaction-export  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-50179 · Severity: medium · CVSS 4.2 · Published 2026-07-07

Actual Budget, a personal finance and budgeting tool, is vulnerable to a security flaw where malicious data can be hidden within transaction records. If a user imports a specially crafted bank statement or file and later exports their data to a spreadsheet (like Excel or Google Sheets), the malicious data can execute as a formula. This could allow an attacker to trick the user into clicking a link that steals sensitive financial information or displays fraudulent transaction details.

Technologies: [Actual Budget](https://junglewise.ai/threats/technologies/actual-budget). Vendors: [Actual Budget](https://junglewise.ai/threats/vendors/actual-budget), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-50179 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50179 being exploited in the wild.

**How severe is CVE-2026-50179?** Medium severity, with a CVSS score of 4.2, published 7 July 2026.

**Which products and versions are affected?** Actual Budget < 26.6.0; @actual-app/web (npm) < 26.6.0, SEMVER:introduced=0,fixed=26.6.0.

**Is there a fix for CVE-2026-50179?** Yes. @actual-app/web (npm): upgrade to 26.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50179 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50179?** Check whether you run Actual Budget or @actual-app/web (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @actual-app/web (npm): upgrade to 26.6.0 or later

  ```sh
  npm install @actual-app/web@26.6.0
  ```


## Technical details

A CSV injection (Formula Injection) vulnerability exists in Actual Budget's `exportToCSV` and `exportQueryToCSV` functions within `packages/loot-core/src/server/transactions/export/export-to-csv.ts`. The application fails to neutralize formula-triggering characters (=, +, -, @, tab, or carriage return) in user-controlled fields such as Payee, Notes, Account, and Category before passing them to the `csv-stringify` library. An attacker can plant malicious payloads by providing a crafted import file (OFX, QIF, CSV) or via the API. When a victim exports the budget and opens it in Excel, LibreOffice, or Google Sheets, these strings execute as formulas (e.g., `=HYPERLINK`, `=WEBSERVICE`), enabling the exfiltration of adjacent cell data to an attacker-controlled server. The issue is fixed in version 26.6.0 by implementing a `cast.string` callback to prefix such strings with a single quote.

## Affected products

- actualbudget Actual Budget < 26.6.0

## Identifiers

- CVE-2026-50179
- GHSA-xqjm-27pc-rvwm

## Timeline

- 2026-05-16: patched: Fix committed to repository
- 2026-06-01: advisory: Version 26.6.0 released
- 2026-06-12: disclosed: Security advisory published on GitHub
- 2026-07-07: other: NVD publication date

## References

- [https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306](https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306)
- [https://github.com/actualbudget/actual/releases/tag/v26.6.0](https://github.com/actualbudget/actual/releases/tag/v26.6.0)
- [https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm](https://github.com/actualbudget/actual/security/advisories/GHSA-xqjm-27pc-rvwm)

## Related threats

- [Actual Budget insufficient session expiration for disabled OpenID users](https://junglewise.ai/threats/cve-2026-49229-actual-budget-insufficient-session-expiration-for-disabled-openid)
- [Actual Budget missing authorization in file management endpoints](https://junglewise.ai/threats/cve-2026-50007-actual-budget-missing-authorization-in-file-management-endpoints)
- [Actual Budget path traversal in actual-server endpoints](https://junglewise.ai/threats/cve-2026-43872-actual-budget-path-traversal-in-actual-server-endpoints)