Actual is a local‑first personal finance application. Before version 26.6.0 its command‑line interface uses a custom CSV serializer whose escapeCsv helper only escapes RFC 4180 delimiters, quotes, and newlines but does not neutralize standard CSV formula‑injection prefixes such as ‘=’, ‘+’, ‘-’, or ‘@’. As a result any user‑controlled strings that are included in exported lists—transactions, accounts, payees, categories, tags, category‑groups, rules, schedules, or queries—can appear in CSV cells that automatically evaluate as formulas when opened in spreadsheet applications. This flaw, classified as a CSV formula injection (CWE‑1236), allows an attacker to execute spreadsheet formulas that can exfiltrate sensitive information or perform unauthorized calculations.

The flaw affects the actualbudget:actual product, specifically the @actual-app/cli component used for exporting data. All releases prior to v26.6.0 use the vulnerable serializer; the issue was fixed in release v26.6.0. The vulnerability is exercised whenever the global --format csv option is invoked on any CLI command that streams an array of objects containing user‑controlled text.

The CVSS base score of 4.6 indicates moderate severity. The EPSS score of < 1 % and its absence from the CISA KEV catalog indicate a low probability of widespread exploitation. The vulnerability arises from improper handling of CSV escaping (CWE‑1236); it requires that an attacker supply or control data that will be exported by the CLI and then open the resulting CSV in a spreadsheet application such as Excel, LibreOffice Calc, or Google Sheets. When such a file is accessed, the injected formula can execute, potentially leaking sensitive data or performing unwanted calculations. The attack does not need remote code execution on the host running Actual; it relies on user interaction to view the CSV, which limits its impact to scenarios where exported data is shared or opened locally.