Skip to content
OpenAdvisories

Package · npm

@actual-app/web

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 4.2
    CVE-2026-50179

    Actual: CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

    Actual is a local-first personal finance tool. Prior to 26.6.0, exportToCSV and exportQueryToCSV in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user-controlled Payee, Notes, Account, and Category strings to csv-stringify with no ca…

    actualbudget actual @actual-app/web npm