Detections
Analytics
SCA: security update for @actual-app/cli (GHSA-7gh7-258j-4mpq)
medium Tenable Cloud Security Plugin ID 443772
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV
serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose
escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping and does not neutralize
standard CSV formula-injection prefixes. Any CLI command that streams an object array containing user-
controlled strings, including transactions list, accounts list, payees list, categories list, tags list,
category-groups list, rules list, schedules list, and query, can emit cells that auto-evaluate when the
resulting CSV is opened in Excel, LibreOffice Calc, or Google Sheets, enabling data exfiltration and
arbitrary formula execution. This issue is fixed in version 26.6.0. (CVE-2026-46672)
Solution
Update the @actual-app/cli library and its related packages to version 26.6.0 or later.See Also
Plugin Details
Severity: Medium
ID: 443772
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 6/23/2026
Updated: 7/8/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.49
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Low
Base Score: 3.2
Temporal Score: 2.4
Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2026-46672
CVSS v3
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 4
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/22/2026
Vulnerability Publication Date: 6/22/2026
Reference Information
CVE: CVE-2026-46672
cwe: CWE-1236