The vulnerability arises from the Electron fused feature ELECTRON_RUN_AS_NODE not being disabled in the macOS desktop version 25.x of the Actual application. An attacker who can place a file on disk or supply command‑line arguments can invoke the signed Actual.app binary with the environment variable ELECTRON_RUN_AS_NODE set to 1, which transforms the app into a Node.js REPL. This grants the attacker the ability to execute arbitrary code that runs with the application's entitlements and signed code, effectively bypassing macOS Gatekeeper review. This is a code‑injection flaw (CWE‑94) and results in remote code execution with the full privileges of the application. The impact is significant for confidentiality, integrity, and availability of the user’s financial data and system.

All installations of the macOS desktop application of Actual prior to version 26.5.0 that were built on Electron 39.2.7 are affected. The issue is resolved in version 26.5.0, which disables the ELECTRON_RUN_AS_NODE fuse, making the vulnerability moot after the upgrade.

The CVSS score is 4.8, indicating a moderate severity. The EPSS score is less than 1 %, reflecting a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to influence the environment in which Actual is launched, such as by dropping a script on disk or manipulating command‑line arguments. The likely attack vector is local, where a user who can write to the application’s directory or launch the binary can trigger the exploit.