Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.8

Actual macOS app can execute any code

CVE-2026-42890 · published 4 months ago
Summary

The macOS version of the Actual personal finance app (versions 25.x) can be tricked into running any code an attacker supplies, because a safety setting is left turned on. This lets a malicious file or command make the app act like a trusted program and do things it shouldn't. Updating to version 26.5.0 or later removes the problem.

What to do
  • Update ryanve actual to version 26.5.0.
Affected software
Ecosystem VendorProductAffected versions
npm ryanve actual < 26.5.0
Fix: upgrade to 26.5.0
Original advisory text
actual Allows Electron to Run As Node
Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary with the ELECTRON_RUN_AS_NODE=1 environment variable set. This converts the application into a Node.js REPL capable of executing arbitrary code that inherits the application's entitlements and code signature, bypassing macOS Gatekeeper review. Version 26.5.0 patches the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
4.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-250Execution with Unnecessary Privileges
CWE-693Protection Mechanism Failure
Timeline
Published12 Jun 2026
Updated26 Oct 2026
First seen8 Jun 2026
Sources
GHSA-7rvm-xjpp-63r9 · GHSA
CVE-2026-42890 · NVD
GHSA-7rvm-xjpp-63r9 · OSV
CVE-2026-42890 · OSV
Track software like this
Free during beta