Where risk starts
Untrusted text exported into CSV can be interpreted as a formula by Excel, LibreOffice Calc or another spreadsheet program.
Practical CSV security guide · updated October 2026
How to prevent CSV formula injection.
A CSV field can become active spreadsheet content when it begins like a formula. This checklist helps you find risky cells, choose a documented handling rule and keep an auditable original.
Do not test with secrets or real customer records. Use a copy and fictional data first. A warning marker identifies cells for review; it does not prove that a file is malicious.
Prefixes to review
=, +, -, @, leading tab/newline controls and locale-specific full-width variants deserve inspection.
Why context matters
-12.50 may be a valid negative amount. Detection should flag it for review instead of silently deciding that it is hostile.
What CSV formula injection means
MITRE classifies this weakness as CWE-1236: an application places untrusted values in a CSV without adequately neutralizing formula elements. The risk appears when a spreadsheet program interprets the exported value as active content.
Quoting a CSV field keeps commas and line breaks inside that field, but it does not necessarily force a spreadsheet to treat the value as plain text. OWASP also warns that separator and quote handling can move a dangerous character to the beginning of a parsed cell.
Review: =HYPERLINK(...), +SUM(...), -1+2, @name, [TAB]=...
Usually plain text: report@example.com, item-123, notes about = signs
Usually plain text: report@example.com, item-123, notes about = signs
A six-step prevention checklist
- Identify every CSV export boundary. Record which fields can contain user, supplier or imported text.
- Parse fields as CSV. Do not search the raw file by line alone; quoted fields may contain commas and line breaks.
- Flag formula-sensitive prefixes after leading controls. Include your supported locales and document whether full-width characters are checked.
- Choose a policy for the exact consumer. An apostrophe or tab prefix may make a cell display as text, but spreadsheet products and later programmatic imports behave differently.
- Write a separate result. Keep the original unchanged and record the row, column, rule and before/after preview for each edit.
- Test the downstream workflow. Open only a synthetic sample in the spreadsheet versions you support, save and reopen it, then test any subsequent import.
Common mistakes
- Checking only an equals sign. Other prefixes and leading control characters can also matter.
- Changing every minus-prefixed value without review. This can corrupt legitimate negative numbers.
- Editing raw lines with a regular expression. CSV quoting and multiline fields make record-aware parsing necessary.
- Overwriting the only copy. A separate output and a change report make rollback and review possible.
- Promising universal safety. OWASP and MITRE describe limitations and product differences; verification must match the actual consumer.
Choose the smallest next step
Free: scan one CSV locally and see record and column positions. USD 9: use CSV Desk offline to clean a file and export a JSON change report. USD 12: request one fixed-scope repaired CSV plus audit report.
Run the free checker Buy CSV Desk for USD 9 Review the USD 12 serviceSources and scope
This educational page is not legal advice, penetration testing or a guarantee that a CSV is safe. The linked checker runs locally and reports conservative review candidates without modifying the file.