A CSV file is plain text. It cannot contain formulas, macros or code. Yet a CSV can still make a spreadsheet do things you did not intend, because the spreadsheet decides what each cell means when it opens the file. That gap is what CSV injection, also called formula injection, exploits.
If you export data that other people typed in, such as form submissions, support tickets, reviews or user profiles, this is worth understanding. If you receive CSVs from others, it is worth a simple habit or two.
What CSV injection is
When a spreadsheet app such as Excel or Google Sheets opens a CSV with its default settings, a cell whose text starts with = is typically treated as a formula and calculated. Here is a harmless demonstration:
name,email,note
Ana Ruiz,ana@example.com,Call back Tuesday
=1+1,ben@example.com,TestOpen that in a spreadsheet and the name in the last row typically shows as 2. Nothing was hacked; the app simply did what it does with formulas.
Now imagine the value came from a public signup form, where anyone can type anything into the name field. When a colleague later exports the signups and opens the file, whatever formula was submitted runs on their machine, inside their spreadsheet, with access to the rest of the sheet. The OWASP page on CSV injection describes the attack and the standard mitigations.
Why =, +, -, @, tab and carriage return matter
The equals sign is the obvious trigger, but it is not the only one. OWASP lists these characters as the ones to watch for at the start of a cell:
| Leading character | Why it matters |
|---|---|
= | Starts a formula in every major spreadsheet app. |
+ and - | Excel and others accept these as the start of a formula, so +1+1 or -2+3 is calculated. |
@ | Excel accepts a leading @ before a function name, a holdover from older spreadsheet programs. |
| Tab and carriage return | Invisible characters that can hide a payload or be skipped by an app before it decides whether a cell is a formula. |
The same characters cause plenty of non-malicious trouble too. Phone numbers such as +44 20 7946 0000, bullet-style notes such as - follow up and social handles such as @ana can turn into errors or unexpected values when a spreadsheet tries to read them as formulas.
Wrapping a field in double quotes does not help on its own. Quotes are part of CSV syntax and are removed when the file is read, so "=1+1" still arrives in the cell as =1+1.
How serious is it, realistically?
The risk depends on several things lining up: untrusted text ends up in an export, someone opens the export in a spreadsheet app, and the formula does something harmful, often with the user’s help.
Two classic examples:
- Data leaks through links. A
HYPERLINKformula can build a web address that includes the contents of other cells, such as emails in the same row. If someone clicks the friendly-looking link text, that data is sent to the attacker’s server as part of the address. - Launching programs. Older attacks abused Excel’s Dynamic Data Exchange (DDE) feature to run commands. Current versions of Excel restrict this and show security warnings, but warnings can be clicked through.
Spreadsheet apps have added warnings and restrictions over time, and behavior varies by app, version and settings. Security practitioners also debate whose problem it is: some see it as a spreadsheet flaw, others as the exporter’s responsibility. In practice, if your exports go to non-technical colleagues and contain text typed by the public, neutralizing formulas is cheap insurance.
How exporters neutralize formulas
The common fix is to make sure no cell starts with a trigger character, by adding a harmless prefix to cells that do. There are two popular prefixes, each with trade-offs.
Apostrophe prefix
=1+1 becomes '=1+1. This is the approach OWASP describes, and spreadsheets show the value as text. The downside is that, depending on the app, the apostrophe may be visible in the cell, and it is a real character in the data, so a script or database that later reads the file will see it.
Tab prefix
A tab character is added in front instead. It is less visible than an apostrophe, which makes the export look cleaner. But it is still a real character in the cell, and apps differ in how they treat leading whitespace, which is exactly why OWASP lists the tab among the characters to watch in incoming data. If you choose this route, test the exported file in the apps your team actually uses.
The negative number problem
A naive sanitizer prefixes every cell that starts with - or +, which turns -5 and +3.2 into text and breaks sums in any numeric column. A better approach leaves plain numbers alone, since a value like -5 is read as a number, not a formula, while still neutralizing something like -2+3.
Sanitizing changes the data. Apply it to files meant for people to open in a spreadsheet, and keep an unsanitized copy for files that will be imported into another system.
Step by step: handling a CSV you receive
- Do not double-click files from unknown sources. Double-clicking usually opens a CSV in a spreadsheet app, which evaluates formulas as soon as the file loads.
- Look before you open. Preview the file in a text editor, or run it through the CSV validator, which flags formula-like cells alongside structural problems.
- Neutralize formula-like cells with a sanitizer before opening or forwarding the file.
- Read warnings. Do not enable external content, data connections or links in a file you did not expect to contain them.
- Be careful with links. Treat clickable cells in exported data with the same suspicion as links in an unexpected email.
- If you produce exports, neutralize formulas at export time so recipients do not have to remember any of this.
Neutralize formulas in your file
The free CSV Formula Sanitizer finds cells that start with =, +, -, @, a tab or a carriage return and prefixes them with an apostrophe or a tab, your choice. It can leave plain numbers such as -5 untouched. Like all the free tools, it runs in your browser and the file is never uploaded.
Exports from the CleanYourDataset workspace neutralize formulas automatically: cells that begin with =, +, - or @ are prefixed with a tab. The export section of the guide and the security page explain the details. Sign up free to clean and export datasets from your account.