Question 1

What is CSV injection?

Accepted Answer

CSV injection (also called formula injection) happens when untrusted text is written into a CSV file and later opened in a spreadsheet app. If a cell begins with =, +, -, or @, Excel and Google Sheets interpret it as a formula and execute it — which can run commands, leak other cells, or trigger malicious links.

Question 2

Is CSV injection a real risk if I never run untrusted code?

Accepted Answer

Yes. The vulnerable code is often a harmless-looking 'export to CSV' feature. The attacker only supplies a field value (like a display name); the victim is whoever opens the export — frequently an admin. The danger is in the spreadsheet's formula evaluation, not your server.

Question 3

How do I prevent CSV injection?

Accepted Answer

Prefix any cell that starts with = + - @ (or tab/carriage return) with a single quote so the spreadsheet treats it as text, and quote/escape fields per RFC 4180. Validate input at the boundary too, since a username or display name should never legitimately start with a formula character.

CSV / Formula Injection

Challenges

Frequently Asked Questions