CVE-2026-46672— Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1005 · Data from Local SystemAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| actualbudget | actual | < 26.6.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-46672
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Actual: CSV Formula Injection in `@actual-app/cli` `--format csv` Output via Custom `escapeCsv` Helper
Source: NVD (National Vulnerability Database)
Vulnerability Description
Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-controlled strings, including transactions list, accounts list, payees list, categories list, tags list, category-groups list, rules list, schedules list, and query, can emit cells that auto-evaluate when the resulting CSV is opened in Excel, LibreOffice Calc, or Google Sheets, enabling data exfiltration and arbitrary formula execution. This issue is fixed in version 26.6.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1236
Source: NVD (National Vulnerability Database)
Vulnerability Title
Actual 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
actualbudget actual是actualbudget团队开源的一个个人财务管理应用。 Actual 26.6.0之前版本存在输入验证错误漏洞，该漏洞源于CSV序列化器escapeCsv助手仅处理RFC 4180定界符、引号和换行符转义，未中和CSV公式注入前缀，可能导致数据泄露和任意公式执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| actualbudget | actual | < 26.6.0 | - |
II. Public POCs for CVE-2026-46672
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-46672
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-46672 (2)
Vendor Advisories for CVE-2026-46672 (1)
Vendor Pages for CVE-2026-46672 (1)
- 🔗 Release v26.6.0 · actualbudget/actual · GitHubx_refsource_MISC
Same Patch Batch · actualbudget · 2026-07-07 · 5 CVEs total
| CVE-2026-49229 | 8.3 HIGH | Actual: Disabled OpenID users keep access through existing session tokens |
| CVE-2026-46700 | 4.3 MEDIUM | Actual: Missing authorization on GET /secret/:name allows non-admin OpenID users to enumer |
| CVE-2026-50179 | 4.2 MEDIUM | Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields |
| CVE-2026-50007 | Actual: Shared users can perform owner-only file management actions |
IV. Related Vulnerabilities
Same product: actual
- CVE-2026-49229
Actual: Disabled OpenID users keep access through existing s - CVE-2026-50179
Actual: CSV Formula Injection in Transaction Export via Impo - CVE-2026-46700
Actual: Missing authorization on GET /secret/:name allows no - CVE-2026-50007
Actual: Shared users can perform owner-only file management - CVE-2026-43872
actual-server has a path traversal vulnerability
Same vendor: actualbudget
- CVE-2026-49229
Actual: Disabled OpenID users keep access through existing s - CVE-2026-50179
Actual: CSV Formula Injection in Transaction Export via Impo - CVE-2026-46700
Actual: Missing authorization on GET /secret/:name allows no - CVE-2026-50007
Actual: Shared users can perform owner-only file management - CVE-2026-43872
actual-server has a path traversal vulnerability
Same weakness: CWE-1236
- CVE-2026-54243
Statamic: CSV formula injection in form submission exports - CVE-2026-14846
Incorrect neutralisation in the PrestaShop firmware - CVE-2026-55452
Snipe-IT: CSV formula injection in Activity Report export - CVE-2026-50179
Actual: CSV Formula Injection in Transaction Export via Impo - CVE-2026-47693
Poweradmin: CSV Injection in log export endpoints allows for
V. Comments for CVE-2026-46672
No comments yet