CVE-2026-50179: Actual Finance CSV Injection Vulnerability

CVE-2026-50179 Overview

CVE-2026-50179 is a CSV formula injection vulnerability in Actual, a local-first personal finance tool. The flaw affects exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts. These functions pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify without a cast callback or formula-prefix neutralization. Strings beginning with =, +, -, @, tab, or carriage return are written verbatim to the exported CSV. When a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, those strings are interpreted as spreadsheet formulas. The issue is fixed in version 26.6.0 and is tracked as [CWE-1236].

Critical Impact
Attackers with the ability to write transaction fields can trigger spreadsheet formula execution on CSV recipients, enabling data exfiltration and attacker-controlled cell display values.

Affected Products

Actual (actualbudget/actual) versions prior to 26.6.0
packages/loot-core CSV export functions exportToCSV and exportQueryToCSV
packages/cli output formatting (packages/cli/src/output.ts)

Discovery Timeline

2026-07-07 - CVE-2026-50179 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-50179

Vulnerability Analysis

The vulnerability is a CSV injection (also called formula injection) issue. Actual's CSV export path serializes transaction fields directly through csv-stringify without sanitizing leading characters that spreadsheet applications treat as formula triggers. Fields such as Payee, Notes, Account, and Category accept arbitrary user input during normal budgeting workflows. An attacker who can write to these fields can craft values that execute as formulas when the CSV is opened. Payload examples include DDE calls, HYPERLINK() functions for data exfiltration, and IMPORTXML() in Google Sheets. Exploitation requires the victim to open the exported file in a spreadsheet application, which reflects the user interaction requirement in the scoring.

Root Cause

The root cause is missing output neutralization when serializing user-controlled strings to CSV. The pre-patch csvStringifyOptions object did not define a cast.string callback. Any transaction field beginning with =, +, -, @, \t, or \r survived unchanged into the exported file. The CSV specification treats these as data, but spreadsheet applications parse them as formulas on open.

Attack Vector

An attacker supplies a malicious string in a transaction field they control, for example by submitting a payment description that begins with =. When the Actual user exports transactions to CSV and opens the file in Excel, LibreOffice Calc, or Google Sheets, the crafted formula executes with the recipient's permissions. This can trigger outbound network requests, disclose local cell references, or display attacker-chosen values in place of the raw transaction data.

typescript

// Security patch in packages/loot-core/src/server/transactions/export/export-to-csv.ts
import { aqlQuery } from '#server/aql';
import { integerToAmount } from '#shared/util';

const FORMULA_TRIGGERS = /^[=+\-@\t\r]/;

const csvStringifyOptions = {
  header: true,
  cast: {
    string: (value: string) =>
      FORMULA_TRIGGERS.test(value) ? "'" + value : value,
  },
};

export async function exportToCSV(
  transactions,
  accounts,

Source: GitHub Commit 0681857. The patch adds a FORMULA_TRIGGERS regex and a cast.string callback that prepends a single quote to any value beginning with a formula trigger, neutralizing spreadsheet parsing.

Detection Methods for CVE-2026-50179

Indicators of Compromise

Transaction records where Payee, Notes, Account, or Category fields begin with =, +, -, @, tab, or carriage return characters.
Exported CSV files from Actual instances running versions earlier than 26.6.0 that contain cells starting with formula triggers.
Outbound network requests from spreadsheet processes (excel.exe, soffice.bin) originating shortly after a user opens an exported Actual CSV.

Detection Strategies

Scan Actual database exports and CSV artifacts for regex ^[=+\-@\t\r] in transaction string columns.
Alert on spreadsheet applications spawning network connections or invoking WEBSERVICE, HYPERLINK, DDE, IMPORTXML, or IMPORTDATA functions.
Review Actual server logs for the installed version and confirm upgrades to 26.6.0 or later.

Monitoring Recommendations

Monitor endpoint telemetry for Office and LibreOffice processes making unexpected outbound HTTP or SMB connections after opening finance-related CSV files.
Track file-open events for CSVs sourced from personal finance tooling and correlate with subsequent process behavior.
Log and review changes to shared Actual budgets from untrusted collaborators, focusing on newly added payees and notes.

How to Mitigate CVE-2026-50179

Immediate Actions Required

Upgrade Actual to version 26.6.0 or later, which adds formula-prefix neutralization in the CSV export path.
Audit existing CSV exports for cells beginning with =, +, -, @, tab, or carriage return and quarantine suspicious files.
Restrict write access to shared Actual budgets and review recent transaction entries from external contributors.

Patch Information

The fix is available in Actual v26.6.0. See the GitHub Release v26.6.0, the GitHub Security Advisory GHSA-xqjm-27pc-rvwm, and the remediation commit 0681857. The patch introduces a FORMULA_TRIGGERS regular expression and a csv-stringifycast.string callback that prepends a single quote to any value beginning with a trigger character.

Workarounds

If upgrading is not immediately possible, avoid opening exported CSVs directly in Excel, LibreOffice Calc, or Google Sheets. Inspect files first with a plain-text editor.
Configure spreadsheet applications to disable automatic formula evaluation on external data and to block DDE and external content by default.
Sanitize CSV exports manually by prepending a single quote to any field beginning with =, +, -, @, \t, or \r.

bash

# Sanitize an existing Actual CSV export by neutralizing formula triggers
awk 'BEGIN{FS=OFS=","} {for(i=1;i<=NF;i++) if($i ~ /^"?[=+\-@\t\r]/) $i="'\''" $i; print}' export.csv > export.sanitized.csv