Cybersecurity glossary
What is CSV Injection?
Learn what CSV injection is, how exported spreadsheet cells become executable formulas in Excel or LibreOffice, the risks of credential theft and data exfiltration, and how to neutralize dangerous cell prefixes.
Definition
CSV Injection is a vulnerability in which untrusted data written into CSV or spreadsheet exports begins with formula markers (=, +, -, @, and related prefixes), so that spreadsheet applications interpret the cell as a formula or command when a user opens the file.
Why CSV injection matters
Exports feel harmless: “download as CSV” for finance, CRM, or support teams. Those files often open directly in Excel or Google Sheets. If a stored username or ticket field starts with =, the spreadsheet may treat it as a formula.
CSV Injection turns your export feature into a delivery channel for client-side formula attacks. The application may never execute anything—yet your users and admins still get compromised when they open the file.
How CSV injection works
Attacker stores a formula-like value
A profile field, comment, or imported record begins with =, +, -, or @.
Application exports the field
A CSV/XLSX download includes the raw value in a cell without neutralization.
Victim opens the spreadsheet
Excel or another client parses the cell as a formula or external call.
Payload runs in the client context
Phishing prompts, data leakage, or legacy command features may trigger.
High-risk export scenarios
Admin CRM exports
Privileged users open attacker-controlled names and notes from customer data.
Billing CSVs
Finance workflows auto-open downloads that include memo or reference fields.
Support ticket dumps
Long free-text fields are ideal places to hide formula prefixes.
Partner data feeds
Automated spreadsheet ingestion can execute formulas during import.
Prevention that works
| Control | Notes |
|---|---|
| Neutralize leading markers | Prefix cells starting with = + - @ with ' or a safe token |
| Escape on export | Apply neutralization in the exporter, not only at input time |
| Prefer literal text APIs | Libraries that force text cells reduce formula interpretation |
| Educate high-risk roles | Warn finance/admin users about untrusted spreadsheet prompts |
| Restrict macros / DDE | Hardened Office policies reduce blast radius on endpoints |
| Scan outbound files | Detect formula-like prefixes in generated exports during QA |
- Inventory every CSV/XLSX export that includes user-influenced strings.
- Neutralize =, +, -, @ (and tab/CR variants) at export time.
- Add unit tests that export formula-prefixed samples and assert neutralization.
- Do not rely on CSV quoting alone as a security control.
- Document safe-handling guidance for admins who open exports.
- Consider streaming exports as plain text downloads with clear content types.
- Review import paths that read spreadsheets into the product.
- Track CSV injection findings as client-abuse issues with user impact.
The practical takeaway
CSV injection is formula abuse delivered through your exports. Neutralize dangerous cell prefixes when writing files, and assume spreadsheet clients will try to execute anything that looks like a formula.
If users can store text that later appears in Excel, your exporter owns the safety of that cell.
Related security terms
Formula Injection
Broader class of formula abuse across spreadsheet and similar interpreters.
Malicious File Upload
Hostile files entering systems through upload paths rather than exports.
Information Disclosure
CSV exports often contain the sensitive fields attackers try to weaponize.
Unrestricted File Upload
Related file-handling weakness on the inbound path.
Frequently asked questions
What is CSV injection in simple terms?
If an application exports user-controlled text into a CSV and someone opens it in Excel, a cell that starts with = can run as a spreadsheet formula—sometimes calling external links or legacy command features.
Is the web application executing the formula?
Usually not. The danger appears when a victim opens the export in a spreadsheet client. The app’s bug is emitting unsafe cell content that those clients will interpret.
What prefixes are dangerous?
Commonly =, +, -, and @. Some environments also treat tab, carriage return, or locale-specific markers as formula starts. Defense should neutralize a broad prefix set.
What attacks are possible?
Credential phishing via crafted hyperlinks, data exfiltration with WEBSERVICE-style functions where enabled, and historically DDE-based command execution on older Office configurations.
How do you prevent CSV injection?
Prefix risky cells with a single quote or another neutralizing character, escape formula markers on export, and prefer formats or libraries that treat all fields as literal text.
Are CSV and Formula Injection the same?
CSV injection is the export/file-shape instance of formula injection. Formula injection also covers other spreadsheet features and non-CSV pipelines that feed formula interpreters.
Does quoting CSV fields fix it?
Standard CSV quoting alone is not enough—Excel may still treat a quoted =cmd|' /C ...' cell as a formula when opened. Neutralize the leading character explicitly.
References
Explore authoritative guidance and frameworks related to csv injection.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.