Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-46672

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-controlled strings, including transactions list, accounts list, payees list, categories li
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7fa75afe4e2c3a7d2de817a5fe383979629a50ba4da7527c7406233b13e7d0f4
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"actual","vendor":"actualbudget","versions":[{"status":"affected","version":"< 26.6.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:846b47d7f5354eea1d20b3ad50006f6ffe1a9fa40409134e8fe45e8e76765dcf · sha256:afc330735c1866ec… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:846b47d7f5354eea1d20b3ad50006f6ffe1a9fa40409134e8fe45e8e76765dcf · sha256:afc330735c1866ec… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-1236","description":"CWE-1236: Improper Neutralization of Formula Elements in a CSV File","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:846b47d7f5354eea1d20b3ad50006f6ffe1a9fa40409134e8fe45e8e76765dcf · sha256:afc330735c1866ec… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"name":"https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306","tags":["x_refsource_MISC"],"url":"https://github.com/actualbudget/actual/commit/068185751c03b42e726e3c60b718413d5f96c306"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:846b47d7f5354eea1d20b3ad50006f6ffe1a9fa40409134e8fe45e8e76765dcf · sha256:afc330735c1866ec… · /containers/cna/references/2
{"name":"https://github.com/actualbudget/actual/pull/7859","tags":["x_refsource_MISC"],"url":"https://github.com/actualbudget/actual/pull/7859"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:846b47d7f5354eea1d20b3ad50006f6ffe1a9fa40409134e8fe45e8e76765dcf · sha256:afc330735c1866ec… · /containers/cna/references/1
{"name":"https://github.com/actualbudget/actual/releases/tag/v26.6.0","tags":["x_refsource_MISC"],"url":"https://github.com/actualbudget/actual/releases/tag/v26.6.0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:846b47d7f5354eea1d20b3ad50006f6ffe1a9fa40409134e8fe45e8e76765dcf · sha256:afc330735c1866ec… · /containers/cna/references/3
{"tags":["exploit"],"url":"https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:846b47d7f5354eea1d20b3ad50006f6ffe1a9fa40409134e8fe45e8e76765dcf · sha256:afc330735c1866ec… · /containers/adp/0/references/0
{"name":"https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq","tags":["x_refsource_CONFIRM"],"url":"https://github.com/actualbudget/actual/security/advisories/GHSA-7gh7-258j-4mpq"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:846b47d7f5354eea1d20b3ad50006f6ffe1a9fa40409134e8fe45e8e76765dcf · sha256:afc330735c1866ec… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer