RCE in Actualbudget Actual

CVE-2026-42890

Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control co…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.001 (2.7th percentile) — read the EPSS interpretation.