CVE-2026-50179

The record

Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no cast callback and no formula-prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker-chosen spreadsheet display values. This issue is fixed in version 26.6.0.

Affected packages

Related vulnerabilities

• CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV… CWE-1236
• CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV… CWE-1236
• CVE-2026-9852 A CSV injection vulnerability exists in SYS600. CWE-1236
• CVE-2026-56652 Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when… CWE-1236
• CVE-2026-19501 CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to… CWE-1236
• CVE-2026-64955 When Microsoft Excel imports a CSV file, it executes cells beginning with certain… CWE-1236
• CVE-2026-47705 TypeBot is a chatbot builder tool. CWE-1236
• CVE-2026-18738 Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that… CWE-1236