Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

actual

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.8npmAmendedPublished

    actual Allows Electron to Run As Node

    CVE-2026-42890 · GHSA-7rvm-xjpp-63r9

    Affected
    • npm actual < 26.5.0
    Fixed in
    26.5.0· Vendor fix available
    Issue
    A electron run as node vulnerability was identified in actual (macOS application, version 25.x (Electron 39.2.7)). Vulnerability Type: Electron Run As Node Description ELECTRONRUNASNODE fuse enabled (Electron 39.2.7) — app can be converted to Node.js REPL for arbitrary code execution Impact An attacker who can place a file on disk or control command-line arguments can invoke the signed Actual.app binary with ELECTRONRUNASNODE=1 to execute arbitrary Node.js code inheriting the apps entitlements and code signature. This bypasses macOS Gatekeeper review of the payload: the Node.js script runs as Actual, under Actuals bundle ID and signed identity, and has access to any entitlements the app carries (network, file access, keychain, automation). Combined with any downloader (browser, mail attachment, Slack link) this becomes a signed-binary-abuse primitive on every Mac with Actual installed.

    Recommended action: Upgrade to 26.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →