npm/@actual-app/sync-server: medium 4.2

Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Action: Upgrade @actual-app/sync-server to 25.11.0 or later.

npm i @actual-app/sync-server@25.11.0

Affected

Fixed versions

Sources

• osv: GHSA-xvp7-8vm8-xfxx
• https://github.com/actualbudget/actual/security/advisories/GHSA-xvp7-8vm8-xfxx
• https://github.com/actualbudget/actual/commit/97482a082d502887ef22514b93e35e4c67f4f30f
• https://github.com/actualbudget/actual
• https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/app-gocardless.js#L263-L264
• https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L25-L27
• https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L83-L85

published 2025-10-20T17:55:59Z · modified 2026-09-10T03:50:30.379264788Z · JSON