CVE-2026-50179

Received Received - Intake

CSV Formula Injection in Actual Finance Tool

Publication date: 2026-07-07

Last updated on: 2026-07-07

Assigner: GitHub, Inc.

Description

Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-07

Last Modified

2026-07-07

Generated

2026-07-08

AI Q&A

2026-07-08

EPSS Evaluated

N/A

NVD

CVE-2026-50179

Affected Vendors & Products

Vendor	Product	Version / Range
actual	local-first_personal_finance_tool	26.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1236	The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the Actual personal finance tool versions prior to 26.6.0. Specifically, the functions exportToCSV and exportQueryToCSV pass user-controlled strings (Payee, Notes, Account, and Category) directly to the csv-stringify library without any neutralization of formula prefixes.

If these strings begin with characters like equals sign (=), plus (+), minus (-), at sign (@), tab, or carriage return, they are preserved verbatim in the exported CSV file. When this CSV file is opened in spreadsheet applications such as Excel, LibreOffice Calc, or Google Sheets, these strings are interpreted as formulas.

This behavior enables attackers to exfiltrate transaction data or manipulate the displayed spreadsheet values by injecting malicious formulas.

The issue was fixed in version 26.6.0 by presumably adding formula-prefix neutralization.

Compliance Impact

The vulnerability allows user-controlled strings to be interpreted as formulas in exported CSV files, which can lead to transaction data exfiltration and manipulation of spreadsheet display values.

This data exfiltration risk could potentially impact compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information from unauthorized access or disclosure.

However, the provided information does not explicitly describe the direct effects on compliance with these standards.

Impact Analysis

This vulnerability can lead to data exfiltration and manipulation when CSV exports from the Actual finance tool are opened in spreadsheet software.

An attacker can craft malicious input strings that, when exported and opened, execute formulas in the spreadsheet application. This can result in unauthorized disclosure of sensitive transaction data or altered display of financial information.

Such impacts can compromise the confidentiality and integrity of your financial data.

Mitigation Strategies

To mitigate this vulnerability, upgrade the Actual personal finance tool to version 26.6.0 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-50179. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70