CVE-2026-50179— Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
Possible ATT&CK Techniques 1AI
T1560.001 · Archive via UtilityAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| actualbudget | actual | < 26.6.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-50179
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
Source: NVD (National Vulnerability Database)
Vulnerability Description
Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1236
Source: NVD (National Vulnerability Database)
Vulnerability Title
Actual 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
actualbudget actual是actualbudget团队开源的一个个人财务管理应用。 Actual 26.6.0之前版本存在输入验证错误漏洞，该漏洞源于exportToCSV和exportQueryToCSV函数在将用户控制的Payee、Notes、Account和Category字符串传递给csv-stringify时，未设置cast回调且未进行公式前缀中和，导致以等号、加号、减号、@符号、制表符或回车符开头的字符串原样保留在导出的CSV中，当接收者在Excel、LibreOffice Ca
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| actualbudget | actual | < 26.6.0 | - |
II. Public POCs for CVE-2026-50179
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50179
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-50179 (1)
Vendor Advisories for CVE-2026-50179 (1)
Vendor Pages for CVE-2026-50179 (1)
- 🔗 Release v26.6.0 · actualbudget/actual · GitHubx_refsource_MISC
Same Patch Batch · actualbudget · 2026-07-07 · 5 CVEs total
| CVE-2026-49229 | 8.3 HIGH | Actual: Disabled OpenID users keep access through existing session tokens |
| CVE-2026-46672 | 4.6 MEDIUM | Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escap |
| CVE-2026-46700 | 4.3 MEDIUM | Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumer |
| CVE-2026-50007 | Actual: Shared users can perform owner-only file management actions |
IV. Related Vulnerabilities
Same product: actual
- CVE-2026-49229
Actual: Disabled OpenID users keep access through existing s - CVE-2026-46700
Actual: Missing authorization on GET /secret/:name allows no - CVE-2026-46672
Actual: CSV Formula Injection in `@actual-app/cli` `--format - CVE-2026-50007
Actual: Shared users can perform owner-only file management - CVE-2026-43872
actual-server has a path traversal vulnerability
Same vendor: actualbudget
- CVE-2026-49229
Actual: Disabled OpenID users keep access through existing s - CVE-2026-46700
Actual: Missing authorization on GET /secret/:name allows no - CVE-2026-46672
Actual: CSV Formula Injection in `@actual-app/cli` `--format - CVE-2026-50007
Actual: Shared users can perform owner-only file management - CVE-2026-43872
actual-server has a path traversal vulnerability
Same weakness: CWE-1236
- CVE-2026-54243
Statamic: CSV formula injection in form submission exports - CVE-2026-14846
Incorrect neutralisation in the PrestaShop firmware - CVE-2026-55452
Snipe-IT: CSV formula injection in Activity Report export - CVE-2026-46672
Actual: CSV Formula Injection in `@actual-app/cli` `--format - CVE-2026-47693
Poweradmin: CSV Injection in log export endpoints allows for
V. Comments for CVE-2026-50179
No comments yet