CVE-2026-42890 Overview
CVE-2026-42890 affects Actual, an open-source personal finance application. The macOS desktop application version 25.x, built on Electron 39.2.7, ships with the ELECTRON_RUN_AS_NODE fuse left enabled. An attacker who can place a file on disk or control command-line arguments can invoke the signed Actual.app binary with ELECTRON_RUN_AS_NODE=1 to convert it into a Node.js REPL. Arbitrary code executed through this path inherits the application's entitlements and Apple Developer ID code signature. This bypasses macOS Gatekeeper review. Version 26.5.0 patches the issue. The vulnerability maps to CWE-94 Improper Control of Generation of Code.
Critical Impact
Attackers gain arbitrary code execution under a trusted, signed application identity, bypassing macOS Gatekeeper controls on the local system.
Affected Products
- Actual Budget macOS desktop application, version 25.x
- Built on Electron 39.2.7 with ELECTRON_RUN_AS_NODE fuse enabled
- Fixed in Actual Budget version 26.5.0
Discovery Timeline
- 2026-06-12 - CVE-2026-42890 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-42890
Vulnerability Analysis
The vulnerability stems from a missing Electron hardening control in the Actual Budget macOS build. Electron ships a set of build-time flags called fuses that toggle runtime behaviors. The ELECTRON_RUN_AS_NODE fuse controls whether the bundled Electron binary honors the ELECTRON_RUN_AS_NODE environment variable. When that variable is set to 1, Electron drops its Chromium frontend and runs as a plain Node.js process. An attacker who launches the signed Actual.app binary with this variable set, or who places a controlled JavaScript file on disk that the application will execute, receives a Node.js REPL running inside the trusted application context. The Node.js process inherits the parent application's Apple code signature, entitlements, and any Transparency, Consent, and Control (TCC) permissions previously granted. macOS Gatekeeper evaluates the binary on first launch and treats subsequent invocations as trusted regardless of the arguments supplied.
Root Cause
The Electron build for Actual Budget 25.x did not disable the ELECTRON_RUN_AS_NODE fuse during packaging. This leaves a documented Electron code execution surface exposed in a signed production binary.
Attack Vector
Exploitation requires local access. The attacker either drops a malicious script on disk and instructs the system to invoke Actual.app against it, or invokes the binary directly with ELECTRON_RUN_AS_NODE=1 set in the process environment. The attacker does not need to bypass code signing, because the existing signature on Actual.app covers the payload's execution context. See the GitHub Security Advisory GHSA-7rvm-xjpp-63r9 for the vendor's technical description.
Detection Methods for CVE-2026-42890
Indicators of Compromise
- Process executions of Actual.app/Contents/MacOS/Actual with ELECTRON_RUN_AS_NODE=1 present in the process environment
- Child processes spawned from Actual.app that match Node.js runtime behavior such as outbound network connections to non-Actual domains or shell command execution
- Unexpected JavaScript files dropped in user-writable locations referenced as arguments to Actual.app
Detection Strategies
- Hunt endpoint telemetry for command lines invoking the Actual binary with environment variables containing ELECTRON_RUN_AS_NODE
- Alert on signed Electron applications executing scripts outside their resource bundle, particularly from /tmp, ~/Downloads, or ~/Library/Application Support paths the application does not normally read
- Correlate Actual.app parent processes with anomalous child processes such as osascript, curl, bash, or further Node.js invocations
Monitoring Recommendations
- Collect macOS Endpoint Security framework events for process exec with full environment variables where supported
- Track installed versions of Actual Budget across the fleet and flag any host still running 25.x
- Review TCC permission grants tied to Actual.app to scope the blast radius of a successful exploit
How to Mitigate CVE-2026-42890
Immediate Actions Required
- Upgrade Actual Budget on every macOS endpoint to version 26.5.0 or later
- Inventory hosts running Actual 25.x and prioritize upgrade or removal
- Revoke or reduce sensitive TCC permissions granted to Actual.app until patched builds are deployed
Patch Information
The vendor released a fix in Actual Budget 26.5.0, which disables the ELECTRON_RUN_AS_NODE fuse in the packaged macOS build. Details are available in the ActualBudget 26.5.0 release notes and the GitHub Security Advisory GHSA-7rvm-xjpp-63r9.
Workarounds
- Remove Actual.app from endpoints where upgrade is not yet possible
- Restrict execution of Actual Budget through an application control policy that blocks invocations carrying ELECTRON_RUN_AS_NODE in the environment
- Limit local account privileges so untrusted users cannot place files in paths read by Actual.app or modify its launch environment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
