@actual-app/web vulnerabilities

CVEs whose affected-version data names the @actual-app/web package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-50179Medium· 4.2

@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields

▾ Sunlitactual-app · @actual-app/webEPSS 0.29%via GHSA

@actual-app/web vulnerabilities (CVEs) · VulnSea