CSV Injection (Formula Injection) Explained

A CSV file is just text, which is why it feels harmless. But a CSV is usually opened in a spreadsheet program, and a spreadsheet program treats some text as instructions. If someone can put text into a field that later ends up in a CSV export, they can sometimes make the next person who opens the file run a formula they did not write. The problem has a name, CSV injection or formula injection, and a weakness number, CWE-1236.

What makes a cell a formula

When Excel, LibreOffice Calc or Google Sheets reads a CSV cell, it decides whether the text is a number, a date, plain text or a formula. A cell that begins with = is a formula. A leading +, - or @ is also read as the start of one in many programs, and a leading tab or carriage return can hide the sign. OWASP's guidance lists exactly these characters.

What a formula can do depends on the program and its settings. Typical examples:

• A formula such as =HYPERLINK("https://example.test/...","Click") that makes a cell look like a normal link to somewhere else.
• Functions that fetch data from a web address (WEBSERVICE, IMPORTXML, IMPORTDATA in Sheets), which can send cell contents to someone else's server inside the address.
• Older DDE-style strings of the form program|topic!item that ask Excel to start another program. Current Excel shows a warning before it does, and treats this as a risk to be blocked, but warnings get clicked away.

The danger does not come from the file format; it comes from user-controlled text reaching an export without being neutralised.

Who is at risk

• Teams that export orders, sign-ups, support tickets or survey answers to CSV and open them in Excel.
• Developers whose application offers a "download as CSV" button on data that users can edit.
• Anyone who receives CSV files from outside, for example a supplier price list.

False alarms: numbers and phone numbers

Many harmless cells start with these characters: negative numbers (-12.50), phone numbers (+8801712345678), social handles (@name). Spreadsheets read most of them as numbers. A useful scanner separates those from real formulas, which the CSV Formula Injection Scanner & Cleaner does with three levels: high for command-like and web-fetching cells, medium for formulas and other risky text, and low for plain numbers and handles.

Cleaning and exporting safely

• On export: for every cell that starts with =, +, -, @, tab or carriage return, put a single quote in front, as OWASP recommends, and quote the cell. Do this in the export code, not in the browser.
• On receipt: scan the file first. The cleaner rewrites only the flagged cells and leaves everything else, including quoting and line endings, as it was.
• Know the trade-off: in a CSV the apostrophe is an ordinary character, so Excel shows it. The value changes, so tell people who use the data, and never clean cells that are meant to be formulas.
• Open safely: import the CSV through a data-import dialog and set columns to text, instead of double-clicking the file.

Cleaning a CSV is a defensive step; it does not make a spreadsheet file safe in general. For Excel workbooks themselves, with macros and links, see the guide to Office macros and embedded objects and the Office Embedded Object & Macro Risk Scanner.