CVE-2026-46672: Actual CLI CSV Formula Injection Vulnerability

Technical summary

The vulnerability exists in packages/cli/src/output.ts, where a custom CSV serializer's escapeCsv helper implements only RFC 4180-compliant escaping for delimiters, quotes, and newlines—but does not strip formula-injection prefixes (=, +, -, @, etc.). Multiple CLI commands that output object arrays with user-controlled strings are affected: transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query. When the resulting CSV is parsed by spreadsheet software, cells prefixed with formula triggers are evaluated as formulas rather than literal text, allowing code execution within the spreadsheet application's sandbox.

Business impact

For Actual users who export financial data via CLI, this vulnerability enables attackers with local machine access to inject formulas into exported datasets. When a user opens the malicious CSV in Excel or similar software, the formulas silently execute, potentially exfiltrating sensitive financial data (account balances, transaction details, personal information) or performing other actions the spreadsheet application permits. Organizations using Actual in automated pipelines or shared environments face elevated risk if untrusted parties can influence the data being exported or if CSV files are shared without validation.

Affected systems

Actual versions prior to 26.6.0 are affected. The vulnerability is triggered only when users export data using the CLI with the --format csv option. Desktop and web versions of Actual are not directly affected unless they invoke the CLI backend. The impact depends on: (1) whether users have local CLI access, (2) whether exported CSVs are opened in formula-enabled spreadsheet applications, and (3) whether the data source contains attacker-controlled content.

Exploitability

Exploitation requires local machine access (AV:L), no special privileges beyond a local user account (PR:L), and user interaction—the user must open the exported CSV in a spreadsheet application that auto-evaluates formulas (UI:R). The barrier to exploitation is low for insiders or attackers who have compromised a user account. However, this is not remotely exploitable and requires the victim to perform an action (opening the file). CVSS score 4.6 reflects medium severity: some scope crossing occurs because formula execution can access system resources outside the spreadsheet, but impact is limited to confidentiality and integrity, not availability.

Remediation

Update Actual to version 26.6.0 or later. The fix modifies the escapeCsv helper to neutralize formula-injection prefixes in addition to RFC 4180 escaping. Users unable to update immediately should avoid exporting CSV files from untrusted or mixed data sources and should treat exported CSVs as potentially unsafe until opened in a restricted environment. Consider disabling CLI CSV export if not needed.

Patch guidance

Deploy version 26.6.0 when available in your release channel. This is a straightforward security update with no known breaking changes. Verify the update by checking Actual's release notes or running the CLI version command post-upgrade. If you maintain a custom build of Actual, audit packages/cli/src/output.ts to confirm the escapeCsv function now includes formula-prefix neutralization (commonly achieved by prefixing cells with a single quote or stripping characters like =, +, -, @, tab).

Detection guidance

Monitor for CLI usage patterns and exported CSV files in environments where Actual is deployed. If using Actual in automation or data pipelines, inspect exported CSVs for cells beginning with formula characters (=, +, -, @). Security information and event management (SIEM) systems can flag spreadsheet files created from Actual exports if a DLP tool is in place. In managed environments, consider restricting CLI access or logging all --format csv invocations for audit purposes.

Why prioritize this

Although the CVSS score is moderate (4.6), prioritize this patch for organizations using Actual's CLI in shared or multi-user environments, or where Actual data includes user-supplied content. The vulnerability is easily exploitable by local users and affects a common export workflow. However, it does not warrant emergency response unless your threat model includes compromised local accounts or insider threats. Standard patch cycles (within 30 days) are appropriate for most deployments.

Risk score, explained

CVSS 4.6 (MEDIUM) reflects: local attack vector and low privileges required limit the addressable attack surface; user interaction is mandatory (spreadsheet must be opened); scope crosses (formula execution can touch OS-level resources); and impact is limited to confidentiality and integrity (no availability impact). The score appropriately downgrades severity compared to a remote, unauthenticated formula-injection flaw, yet acknowledges that local users can realistically exploit this to exfiltrate financial data.

Frequently asked questions