GHSA-xvp7-8vm8-xfxx Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Not scored Published 20 Oct 2025

The Actual Budget sync server logs sensitive banking data, including bearer tokens and account numbers, to standard output, exposing PII and financial details.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-xvp7-8vm8-xfxx?

GHSA-xvp7-8vm8-xfxx is a vulnerability in @actual-app/sync-server, published on 20 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using console.logand console.debug (Which in this version of node is an alias for console.log). This is exposing sensitive information in log files including, but not limited to:

Gocardless bearer tokens.
Account IBAN and Bank Account numbers.
PII of the account holder.
Transaction details (Payee bank information, Recipient account numbers, Transaction IDs)…

Details

Whenever GoCardless responds to a request, the payload is printed to the debug log: https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L25-L27

This in turn logs the following information to Docker (all values removed here. These fields are possibly dependent on what is returned by each institution so may differ):

{
  &#34;account&#34;: {
    &#34;resourceId&#34;: &#34;&#34;,
    &#34;iban&#34;: &#34;&#34;,
    &#34;bban&#34;: &#34;&#34;,
    &#34;currency&#34;: &#34;&#34;,
    &#34;name&#34;: &#34;&lt;full legal name in the bank&gt;&#34;,
    &#34;product&#34;: &#34;&#34;,
    &#34;status&#34;: &#34;&#34;,
    &#34;bic&#34;: &#34;&#34;,
    &#34;usage&#34;: &#34;&#34;,
    &#34;id&#34;: &#34;&#34;,
    &#34;created&#34;: &#34;&#34;,
    &#34;last_accessed&#34;: &#34;&#34;,
    &#34;institution_id&#34;: &#34;&#34;,
    &#34;owner_name&#34;: &#34;&#34;,
    &#34;institution&#34;: {
      &#34;id&#34;: &#34;&#34;,
      &#34;name&#34;: &#34;&#34;,
      &#34;bic&#34;: &#34;&#34;,
      &#34;transaction_total_days&#34;: &#34;&#34;,
      &#34;countries&#34;: [
        &#34;&#34;
      ],
      &#34;logo&#34;: &#34;&#34;,
      &#34;max_access_valid_for_days&#34;: &#34;&#34;,
      &#34;supported_features&#34;: [
        &#34;&#34;,
        &#34;&#34;,
        &#34;&#34;
      ],
      &#34;identification_codes&#34;: []
    }
  }
}

https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L83-L85

This is the first of the 10 transactions:

{
  &#34;top10Transactions&#34;: [{
    &#34;transactionId&#34;: &#34;&#34;,
    &#34;entryReference&#34;: &#34;&#34;,
    &#34;bookingDate&#34;: &#34;&#34;,
    &#34;valueDate&#34;: &#34;&#34;,
    &#34;transactionAmount&#34;: {
      &#34;amount&#34;: &#34;&#34;,
      &#34;currency&#34;: &#34;&#34;
    },
    &#34;creditorName&#34;: &#34;&#34;,
    &#34;creditorAccount&#34;: {
      &#34;bban&#34;: &#34;&#34;
    },
    &#34;debtorName&#34;: &#34;&#34;,
    &#34;debtorAccount&#34;: {
      &#34;bban&#34;: &#34;&#34;
    },
    &#34;remittanceInformationUnstructured&#34;: &#34;&#34;,
    &#34;remittanceInformationStructuredArray&#34;: [
      {&#34;reference&#34;: &#34;&#34;, &#34;referenceType&#34;: &#34;&#34;}
    ],
    &#34;additionalInformation&#34;: &#34;&#34;,
    &#34;proprietaryBankTransactionCode&#34;: &#34;&#34;,
    &#34;debtorAgent&#34;: &#34;&#34;,
    &#34;internalTransactionId&#34;: &#34;&#34;,
    &#34;payeeName&#34;: &#34;&#34;,
    &#34;date&#34;: &#34;&#34;
  }]
}

Additionally, in the error handling for GoCardless, there is a catch all for unclassified errors that prints the entire stack trace to the console.

https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/app-gocardless.js#L263-L264

Our bank was offline today for maintenance which threw a 503 error from Gocardless. The entire response payload was dumped to console, which includes the Bearer tokens for accessing GoCardless:

Something went wrong ServiceError: Institution service unavailable
    at handleGoCardlessError (file:///app/src/app-gocardless/services/gocardless-service.js:59:13)
    at Object.getTransactions (file:///app/src/app-gocardless/services/gocardless-service.js:530:7)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.getNormalizedTransactions (file:///app/src/app-gocardless/services/gocardless-service.js:267:26)
    at async file:///app/src/app-gocardless/app-gocardless.js:186:13 {
  details: h [AxiosError]: Request failed with status code 503
      at te (file:///app/node_modules/nordigen-node/dist/index.esm.js:13:914)
      at IncomingMessage.&lt;anonymous&gt; (file:///app/node_modules/nordigen-node/dist/index.esm.js:17:16315)
      at IncomingMessage.emit (node:events:529:35)
      at endReadableNT (node:internal/streams/readable:1400:12)
      at process.processTicksAndRejections (node:internal/process/task_queues:82:21) {
    code: &#39;ERR_BAD_RESPONSE&#39;,
    config: {
      transitional: {
        silentJSONParsing: true,
        forcedJSONParsing: true,
        clarifyTimeoutError: false
      },
      adapter: [ &#39;xhr&#39;, &#39;http&#39; ],
      transformRequest: [ [Function (anonymous)] ],
      transformResponse: [ [Function (anonymous)] ],
      timeout: 0,
      xsrfCookieName: &#39;XSRF-TOKEN&#39;,
      xsrfHeaderName: &#39;X-XSRF-TOKEN&#39;,
      maxContentLength: -1,
      maxBodyLength: -1,
      env: {
        FormData: [Function: _] {
          LINE_BREAK: &#39;\r\n&#39;,
          DEFAULT_CONTENT_TYPE: &#39;application/octet-stream&#39;
        },
        Blob: [class Blob]
      },
      validateStatus: [Function: validateStatus],
      headers: T [AxiosHeaders] {
        Accept: &#39;application/json&#39;,
        &#39;Content-Type&#39;: &#39;application/json&#39;,
        &#39;User-Agent&#39;: &#39;Nordigen-Node-v2&#39;,
        &#39;Authorization&#39;: &#39;Bearer eyJ0eXAi... (the full token is in the response)&#39;,
        &#39;Accept-Encoding&#39;: &#39;gzip, compress, deflate, br&#39;
      },
      method: &#39;get&#39;,
      url: URL {
        href: &#39;https://bankaccountdata.gocardless.com/api/v2/accounts/&lt;Account id Was Here&gt;?date_from=2024-12-22&#39;,
        origin: &#39;https://bankaccountdata.gocardless.com&#39;,
        protocol: &#39;https:&#39;,
        username: &#39;&#39;,
        password: &#39;&#39;,
        host: &#39;bankaccountdata.gocardless.com&#39;,
        hostname: &#39;bankaccountdata.gocardless.com&#39;,
        port: &#39;&#39;,
        pathname: &#39;/api/v2/accounts/&lt;Account id Was Here&gt;/transactions&#39;,
        search: &#39;?date_from=2024-12-22&#39;,
        searchParams: URLSearchParams { &#39;date_from&#39; =&gt; &#39;2024-12-22&#39; },
        hash: &#39;&#39;
      },
      data: undefined
    },

And quite a few pages more.

PoC

Setup an Actualbudget server inside of Docker. In this instance I was using the Docker Compose script posted in the repository: https://github.com/actualbudget/actual/blob/master/packages/sync-server/docker-compose.yml
Link a gocardless account to Actualbudget and sync a bank account
Observe in the container using docker logs actual-actual_server-1 -f that sensitive details are logged to the console and ingested by docker.

Impact

Information disclosure. The services are available both on-premises and in environments that are not under the control of the end user, such as third-party providers who offer this application as a managed solution.

Which versions are affected by GHSA-xvp7-8vm8-xfxx?

2 open source packages ship an affected version, including @actual-app/sync-server.

Package	Affected	Fixed in
`@actual-app/sync-server` npm	All versions	`25.11.0`
`@actual-app/sync-server` npm	All versions	`25.11.0`

How do I fix GHSA-xvp7-8vm8-xfxx?

Upgrade @actual-app/sync-server to 25.11.0 or later.

Is GHSA-xvp7-8vm8-xfxx being exploited?

There is no known exploitation of GHSA-xvp7-8vm8-xfxx in the wild and no public exploit code.