Actual is a local‑first personal finance tool whose export functions write transaction fields to CSV without filtering or neutralizing characters that trigger spreadsheet formulas. Fields such as Payee, Notes, Account, and Category that begin with equals, plus, minus, at sign, a tab, or a carriage return are written verbatim. When a user later opens the exported file in Excel, LibreOffice Calc, or Google Sheets, those leading characters cause the application to evaluate the string as a formula, allowing the attacker to craft spreadsheet expressions that can exfiltrate transaction data or manipulate how the file is displayed. This is a Code Injection vulnerability (CWE‑1236) that does not provide remote code execution but can compromise confidentiality and integrity of exported data.

Any installation of the Actual personal finance application prior to release 26.6.0 is affected. The vendor product listed by the CNA is actualbudget:actual, an open‑source tool. Users running versions older than 26.6.0 should verify their product version and plan remediation accordingly.

The CVSS score of 4.2 indicates moderate severity because the flaw targets local data export rather than enabling arbitrary code execution. The EPSS score is less than 1 %, showing a very low but non‑zero probability of exploitation in the wild. The vulnerability is not catalogued in CISA KEV. The attack requires the attacker to control or supply the CSV file that a user will later open in a spreadsheet application; this is inferred from the description, as the export process itself does not provide an external trigger. Once the file is opened, the injected formulas execute automatically, exposing data and allowing malicious spreadsheet display. The flaw is best classified as a Code Injection scenario (CWE‑1236).