Information Exposure Affecting @actual-app/sync-server package, versions *
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-ACTUALAPPSYNCSERVER-13644643
- published21 Oct 2025
- disclosed20 Oct 2025
- creditStuart Brown
Introduced: 20 Oct 2025
New CVE NOT AVAILABLE CWE-215 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
@actual-app/sync-server is an actual syncing server
Affected versions of this package are vulnerable to Information Exposure via the console.log and console.debug functions, which log sensitive response payloads from external services, including bearer tokens, account numbers, and personally identifiable information, to standard output and log files. An attacker can gain unauthorized access to confidential information by obtaining access to these logs in environments where logs are accessible to unauthorized parties, such as shared or managed hosting environments.