CVE-2026-50179: Actual CSV Injection Vulnerability – Formula Injection in Financial Exports

Technical summary

The vulnerability exists in the exportToCSV and exportQueryToCSV functions within Actual's transaction export module. User-controlled input from Payee, Notes, Account, and Category fields is passed directly to the csv-stringify library without a cast callback function or formula-prefix neutralization. CSV injection occurs when strings beginning with formula triggers (=, +, -, @, tab, or carriage return) are written verbatim to the output file. Spreadsheet applications interpret these prefixes as formula delimiters, allowing arbitrary code execution within the spreadsheet context. The fix in version 26.6.0 implements proper input sanitization to prevent formula injection.

Business impact

For users of Actual, the primary risk is data exfiltration through maliciously crafted formulas embedded in exported CSV files. If transaction data is shared with accountants, financial advisors, or business partners, those recipients could unknowingly execute formulas that leak sensitive financial details. Additionally, attackers could manipulate displayed values in spreadsheets to deceive recipients about account balances, transaction amounts, or other critical financial information. The attack requires user interaction (opening the file in a spreadsheet application) and attacker ability to influence transaction data, limiting the immediate blast radius but creating significant trust and compliance risks in multi-user or shared financial workflows.

Affected systems

Actual versions prior to 26.6.0 are affected. The vulnerability applies to any exported CSV file containing transaction data where the user has not manually validated field content. Risk is highest in scenarios where exported files are shared externally or processed by automated systems that execute formulas.

Exploitability

Exploitation requires two conditions: (1) the attacker must be able to introduce malicious data into Actual (via account compromise, shared workspace, or social engineering), and (2) a recipient must open the exported CSV file in a formula-aware spreadsheet application such as Excel, Google Sheets, or LibreOffice Calc. The CVSS score of 4.2 (MEDIUM) reflects the need for network access and user interaction. The attack surface is moderate—any user with write access to transactions can craft malicious payee or note fields—but the impact on confidentiality and integrity is limited to data visible within the spreadsheet context.

Remediation

Update Actual to version 26.6.0 or later, which includes proper sanitization of formula-prefix characters in exported CSV data. Users on earlier versions should avoid sharing exported CSV files with untrusted parties and consider manually inspecting exported data before distribution. For high-sensitivity workflows, disable CSV export or enforce controls that prevent users from modifying transaction metadata that appears in exports.

Patch guidance

Apply the update to Actual version 26.6.0 as soon as feasible. The fix is in the core transaction export module and does not require configuration changes. Verify the patch is applied by confirming the version number in the application settings or release notes. After updating, re-export any previously generated CSV files that may have been created with untrusted or adversarial data, or audit those files for suspicious formulas before sharing.

Detection guidance

Inspect CSV exports for cells beginning with =, +, -, @, tab, or carriage return characters, especially in Payee, Notes, Account, and Category columns. These are indicators of formula injection. Monitor Actual logs for unusual changes to transaction metadata that could signal account compromise. If CSV files have been exported and shared, review recipient access patterns and any spreadsheet applications they used to open those files. Network monitoring may detect data exfiltration attempts if formulas were designed to send data to external endpoints.

Why prioritize this

While the CVSS score is MEDIUM (4.2), prioritize this vulnerability based on your use of Actual and the sensitivity of exported financial data. Organizations that routinely export and share transaction data externally, particularly in multi-user or outsourced accounting scenarios, should treat this as higher priority. For individual or internal-use-only deployments, the risk is lower but still warrants timely patching given the low complexity of exploitation.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects a low-to-medium risk posture: Network-accessible via CSV export (AV:N), but requires relatively high attack complexity (AC:H) because the attacker must introduce malicious data into the application and the victim must open the file in a formula-aware application (UI:R). Scope is unchanged (S:U), and impact is limited to low confidentiality and low integrity loss (C:L/I:L) with no availability impact (A:N). The score does not account for business context such as the sensitivity of financial data or the prevalence of CSV export in accounting workflows.

Frequently asked questions