CVE-2026-50179 actualbudget CVE debrief

Who should care

Users of Actual local-first personal finance tool versions prior to 26.6.0 should review and apply the patch to prevent potential data exfiltration via malicious CSV exports. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security of financial data.

Technical summary

The exportToCSV and exportQueryToCSV functions in Actual's loot-core package pass user-controlled input to csv-stringify without proper sanitization. This allows specially crafted input to be interpreted as formulas when opened in spreadsheet applications like Excel, potentially leading to data exfiltration and unauthorized display of attacker-controlled values. The issue is fixed in version 26.6.0.

Defensive priority

Medium priority due to the specific conditions required for exploitation and the availability of a patch.

Recommended defensive actions

• Update Actual to version 26.6.0 or later
• Review and sanitize user-controlled input to csv-stringify
• Implement compensating controls for CSV export validation
• Monitor for suspicious CSV export activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix. Additional information from source references is needed for further analysis. Evidence limits suggest that Actual's export functionality may be vulnerable to formula injection attacks, allowing for potential data exfiltration. Defenders should verify the patch application and review user-controlled input sanitization.

Official resources