A CSV export can become an active document when someone opens it in a spreadsheet. Cells beginning with characters such as =, +, -, or @ may be interpreted as formulas. If the value came from a service request, a user profile, or an external feed, opening the file can execute a formula in the recipient's spreadsheet context. The file is still plain text, but the consumer is an interpreter.
OWASP documents this problem as CSV injection or formula injection. Quoting a value as CSV does not necessarily prevent the spreadsheet from treating the cell as a formula. A system that escapes commas and quotes correctly can still preserve a leading formula character. The security decision has to account for the spreadsheet program rather than only the CSV grammar.
Find every export path
Inventory user-controlled fields that reach CSV, TSV, XLSX, and spreadsheet-compatible text exports. Look for exports used by support teams, finance, analytics, and scheduled email reports. A customer name may be safe in the web interface but dangerous after it is exported and reopened. Re-importing a downloaded file into another workflow creates a second opportunity for the same value to change meaning.
The producer should mark untrusted text before it reaches the spreadsheet parser. A common mitigation is to prefix dangerous values with a single quote or another documented neutralizer and then test the result in the supported spreadsheet versions. Another is to generate the file in a format that stores values as strings rather than formulas. The right method depends on the consumer and should be enforced in one shared export library, not copied into each report.
Treat the download path as an authorization decision too. An export may contain data the user cannot view in the UI because a column filter was not applied. Reuse the same row and field authorization rules used for the screen. Apply rate limits and audit logs to bulk exports, especially when the file contains customer or security records.
Test the recipient's interpreter
Create cells with a formula marker, a leading apostrophe, a tab, a newline, a quoted comma, and Unicode variations of formula characters. Open the generated file in the spreadsheet applications the organization actually supports. Check formulas, displayed text, sorting, and round-trip import. A mitigation that changes the visible data should be documented for users who rely on exact identifiers.
Do not run an untrusted formula in a production spreadsheet profile with access to sensitive drives or network paths. Use a test account with external links and macros disabled, and do not rely on warnings that users may dismiss. If the export contains values that must remain byte-exact, provide a machine-readable format and make the spreadsheet copy a display-only artifact.
Keep the original value in the source system. Neutralization belongs at the export and presentation boundary so the database does not silently acquire apostrophes or escaped prefixes. When a downstream system imports the CSV, decode the agreed escaping format rather than stripping characters heuristically.
Add monitoring and review
Log the exporter, file format, selected columns, row count, and policy version. Do not log full sensitive cells. Alert when a new column appears in a report or when a bulk export jumps far above its baseline. A malicious formula may not trigger an injection filter if the export service is simply streaming a stored database field.
Review formulas generated by the organization as a separate supply-chain concern. Templates that use external links, dynamic data connections, or macros should be signed and controlled. A formula-injection fix protects untrusted cells, but it does not make an unsafe official template safe.
The defensive sequence is: identify every spreadsheet consumer, apply a documented cell-neutralization policy, test with the supported applications, preserve the raw value, and monitor export volume and column changes. The control belongs where untrusted input becomes an interpreted file, not in a user reminder to open CSV carefully.