Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the improper handling of user-provided data when exporting to CSV format. The core issue is the lack of sanitization for characters that spreadsheet applications like Excel or Google Sheets interpret as the start of a formula (e.g., '=', '+', '-', '@'). An attacker could craft malicious input for fields like 'Payee' or 'Notes' during a transaction import. When this data is later exported to a CSV file, these crafted strings are written verbatim. Upon opening the CSV, the spreadsheet software executes the embedded formulas, which can lead to data exfiltration or other malicious actions.
The analysis of the patch commit 068185751c03b42e726e3c60b718413d5f96c306 confirms this. The changes are centered around neutralizing these special characters.
In packages/loot-core/src/server/transactions/export/export-to-csv.ts, the functions exportToCSV and exportQueryToCSV are modified to pass a cast.string option to the csv-stringify library. This new option uses a regular expression (/^[=+\-@\t\r]/) to test if a string value starts with a formula-triggering character and, if so, prefixes it with a single quote (') to render it inert.
Similarly, in packages/cli/src/output.ts, the formatCsv function is updated to use a new helper, formatCsvCell. This helper performs the same check and neutralization for data being exported to CSV via the command-line interface, ensuring both the web application and the CLI are protected against this vulnerability. The functions exportToCSV, exportQueryToCSV, and formatCsv are therefore the key vulnerable functions that would appear in a runtime profile during the exploitation of this flaw.
exportToCSVpackages/loot-core/src/server/transactions/export/export-to-csv.ts
exportQueryToCSVpackages/loot-core/src/server/transactions/export/export-to-csv.ts
formatCsvpackages/cli/src/output.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @actual-app/web | npm | < 26.6.0 | 26.6.0 |