Actual is a local‑first personal finance tool. Prior to version 26.6.0, the exportToCSV and exportQueryToCSV functions in packages/loot-core/src/server/transactions/export/export-to-csv.ts pass user‑controlled Payee, Notes, Account, and Category strings to csv‑stringify with no cast callback and no formula‑prefix neutralization. Strings that begin with equals sign, plus, minus, at sign, tab, or carriage return survive verbatim into the exported CSV, and when a recipient opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas, enabling transaction data exfiltration and attacker‑chosen spreadsheet display values. The vulnerability is a Code Injection flaw (CWE‑1236) and is addressed in Actual 26.6.0.

Any installation of Actual with a release earlier than 26.6.0 is vulnerable; the vendor addressed the issue in the 26.6.0 release. The affected product is the open‑source personal finance application from Actual, identified in the CNA as actualbudget:actual.

The CVSS score of 4.2 reflects moderate severity because the flaw does not provide remote code execution but enables spreadsheet‑based data leakage. The EPSS score is less than 1 %, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to supply or control the exported CSV file, making it a local‑to‑user attack vector; once the file is opened in a spreadsheet program, the injected formulas are executed. The flaw is a Code Injection vulnerability (CWE‑1236).