PatchSiren cyber security CVE debrief
CVE-2026-42890 actualbudget CVE debrief
A vulnerability was discovered in the Actual open-source personal finance application for macOS, specifically in version 25.x, which is built on Electron 39.2.7. The issue arises from the ELECTRON_RUN_AS_NODE fuse not being disabled, allowing an attacker to invoke the signed Actual.app binary with the ELECTRON_RUN_AS_NODE=1 environment variable. This action converts the application into a Node.js REPL capable of executing arbitrary code that inherits the application's entitlements and code signature. Consequently, this bypasses macOS Gatekeeper review, posing a significant security risk. The vulnerability has been patched in version 26.5.0.
- Vendor
- actualbudget
- Product
- actual
- CVSS
- MEDIUM 4.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-12
- Original CVE updated
- 2026-06-12
- Advisory published
- 2026-06-12
- Advisory updated
- 2026-06-12
Who should care
Users of the Actual macOS desktop application, particularly those using version 25.x, should be aware of this vulnerability. Additionally, security teams and administrators responsible for managing software updates and security patches for personal finance applications should prioritize updating to version 26.5.0 or later.
Technical summary
The vulnerability in the Actual macOS desktop application (CVE-2026-42890) is due to the ELECTRON_RUN_AS_NODE fuse not being disabled. This allows an attacker to execute arbitrary code by invoking the signed application with the ELECTRON_RUN_AS_NODE=1 environment variable, effectively turning the application into a Node.js REPL. This bypasses macOS Gatekeeper, as the executed code inherits the application's entitlements and code signature.
Defensive priority
MEDIUM
Recommended defensive actions
- Update the Actual macOS desktop application to version 26.5.0 or later.
- Ensure that the ELECTRON_RUN_AS_NODE fuse is disabled in the application configuration.
Evidence notes
The vulnerability was patched in version 26.5.0 of the Actual macOS desktop application. Users can refer to the official release notes at [ref-4] for more details. The advisory can also be found at [ref-5].
Official resources
CVE-2026-42890 was published on 2026-06-12T20:16:45.580Z.