GHSA-xvp7-8vm8-xfxx: 
JavaScript vulnerability analysis and mitigation

The GoCardless components in Actualbudget are logging sensitive responses to STDOUT using console.log and console.debug, exposing critical information in log files. This vulnerability (GHSA-xvp7-8vm8-xfxx) was discovered and published on October 18, 2025, affecting @actual-app/sync-server versions <= 25.10.0. The issue exposes sensitive data including GoCardless bearer tokens, account IBAN numbers, bank account numbers, PII of account holders, and detailed transaction information (GitHub Advisory).

The vulnerability stems from excessive and insecure logging practices within the sync-server package. The application logs complete response payloads to debug logs, including sensitive API responses and error traces. The issue manifests in multiple components: normalizeAccount, sortTransactions, and calculateStartingBalance functions in integration-bank.js, and error handling in app-gocardless.js. The vulnerability has been assigned a CVSS v3.1 score of 4.2 (Moderate) with vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N, indicating local access requirements but high confidentiality impact (Miggo).

The vulnerability results in information disclosure of highly sensitive financial and personal data. The exposed information includes GoCardless bearer tokens, account IBANs, bank account numbers, account holder PII, and detailed transaction information including payee bank details and transaction IDs. This exposure is particularly concerning as the services are available both on-premises and in environments not under end-user control, such as third-party managed solutions (GitHub Advisory).

The vulnerability can be exploited by accessing the application logs, which requires local access and high privileges. A proof of concept demonstrates that by setting up an Actualbudget server inside Docker, linking a GoCardless account, and syncing a bank account, sensitive details are logged to the console and ingested by Docker logs. The exploit can be observed using the command 'docker logs actual-actual_server-1 -f' (GitHub Advisory).

The issue has been addressed in version 25.11.0 of the package. Users are advised to update to this patched version. The fix involves removing debug logging and modifying error logging to only output error messages instead of full objects. There are no known workarounds for this vulnerability other than updating to the patched version (GitHub Advisory).