CVE-2026-42890

CVE-2026-42890

Actual is an open-source personal finance application. In the macOS desktop application version 25.x (built on Electron 39.2.7), the ELECTRON_RUN_AS_NODE fuse is not disabled, allowing an attacker who can place a file on disk or control co…

Vulnerability class: RCE (Remote Code Execution)

Weakness classification (CWE)

References