The Actual app (actualbudget) before version 26.6.0 uses a custom CSV serializer in its CLI that inadequately escapes CSV content. Specifically, the escapeCsv helper only handles RFC 4180 delimiter, quote, and newline escaping but fails to neutralize formula-injection prefixes that spreadsheet software interprets as executable formulas. This vulnerability affects any CLI command that outputs user-controlled strings in CSV format, such as transactions, accounts, payees, categories, tags, category-groups, rules, schedules, and queries. Opening such CSV files in common spreadsheet applications can trigger formula execution, enabling potential data exfiltration or arbitrary formula execution. The vulnerability is addressed in version 26.6.0.

An attacker can craft CSV files containing malicious formulas that execute automatically when opened in spreadsheet software, potentially leading to data exfiltration or arbitrary code execution within the spreadsheet context. The vulnerability requires local or limited privileges (AV:L, PR:L) and user interaction (UI:R) to open the malicious CSV file. The impact includes confidentiality and integrity loss but no availability impact. The CVSS score is 4.6 (medium severity).

Upgrade the Actual app to version 26.6.0 or later, where the CSV injection vulnerability is fixed by properly neutralizing formula prefixes in CSV exports. Until upgrading, avoid opening CSV files generated by vulnerable versions in spreadsheet applications or sanitize CSV content manually to neutralize formula injection vectors.