CSV injection (sometimes called formula injection) is a technique allowing hackers to hide malicious formulas within an innocent-looking CSV file. This could lead to data theft, sabotage, or (rarely) arbitrary code execution when opened in a spreadsheet program. If you’d like to better understand this vulnerability or learn to prevent CSV injection attacks, keep reading. I’ll explain how spreadsheet injection works, what its limitations are, and how you can protect yourself.

What is a CSV injection attack?

When you export information from a spreadsheet or database, it’s often stored in a .CSV file. This stands for Comma Separated Values, and it’s nothing fancy, just a plain-text file where values are separated by a specific character (typically a comma, but not always).

Diagram showing the difference between a table and CSV file

So if CSV files are just another way of formatting data, how can they be dangerous?

Remember that these are primarily opened with spreadsheet software, and spreadsheets can use formulas to automatically perform certain tasks. If an attacker inserts a formula into an improperly protected database, it’ll run automatically when the exported CSV file is opened.

Diagram showing how attackers use CSV injection to steal information
In this example, I’ve entered a malicious formula instead of my name. When exported to CSV and opened in a spreadsheet program, this inserts a link that steals user data when clicked.

Thankfully, most services capable of exporting CSV files use data-sanitization. This identifies potentially dangerous entries by looking for fields beginning with special characters (like “+”, “=”, “@”, or “-”). These are rendered harmless by adding a single quotation mark, removing command characters, or only exporting calculated values, not formulas themselves.

How to protect yourself from CSV injection

Follow these steps to protect yourself from CSV injection:

  • Use data validation to limit the types of data users can submit. For instance, there’s no need to allow special characters in a “first name” field.
  • Employ data-sanitization processes to ensure users can’t sneak malicious formulas into your database.
  • Never work with raw user input. Before converting data to a CSV, make sure anything risky is removed or has a single quote (‘) at the beginning.
  • Create a validation script that adds a single quote before command characters. Run CSV files through this before importing them.
  • Manually review CSV files before import. Every system is fallible, so if possible, it’s a good idea to manually verify your data doesn’t include anything dangerous.

What are the different types of CSV injection attack?

There are three main ways an attacker can cause problems using CSV injection. Below, I’ll cover each type of formula injection attack and explain how to mitigate the risk as much as possible.

Inserting malicious links

Diagram showing how attackers use CSV injection to steal information

Earlier, we saw an example where I created a link that stole user data. This type of formula is particularly dangerous since it can exfiltrate lots of sensitive information very quickly. Worse, it can create a cascade effect, with attackers using stolen data to commit further crimes. For instance, if credentials are stored in plaintext, an attacker can simply use them to breach the victim’s account.

Not every attack has to be this sophisticated, though. An unexpected hyperlink in an otherwise normal-looking document is enough to get most people to take a closer look. If you’re not careful, you could accidentally end up opening a shady link. Aside from stealing data, this could:

How to prevent this type of spreadsheet injection: Luckily, most programs have built-in protection against this sort of thing. Excel and Google Sheets require multiple clicks before opening links, while LibreOffice requires you to press Control while clicking. Regardless, it’s a good idea to treat any hyperlinks in a spreadsheet with suspicion.

Intentionally sabotaging data

Attackers can also attempt to create problems with your data. For instance, they could overwrite certain cell values or cause legitimate formulas to produce incorrect results. While unlikely, it would be a real headache if a compromised CSV file was used to generate reports. After all, any changes that fly under the radar could potentially go months without being discovered.

Diagram showing how CSV injection can be used to throw off analytics

This type of manipulation is less dangerous, but can still cause problems. For instance, this one injection has raised the apparent average age of our users by around 1,000 years.

How to prevent this type of spreadsheet injection: Thankfully, the impact of this attack is limited since it’s not possible to overwrite multiple fields using a single formula. Additionally, it’s unlikely any permanent damage would be done since the original data can be backed up from the database (or the CSV file, once the offending formula is dealt with).

Social engineering

Rather than compromising a system directly, attackers may try to get you to do their dirty work. This is called social engineering, and it can be used to great effect alongside malicious hyperlinks. For instance, the attacker could include a note seemingly from another administrator that links to a fake login screen.

Alternatively, they could falsely claim that you’ve accidentally leaked the whole database and threaten to report it unless you pay up. There are an infinite number of schemes, but they all rely on you making decisions without carefully weighing the risks.

Diagram showing how CSV injection can be used for social engineering

How to prevent this type of spreadsheet injection: If you see anything suspicious, raise it with a superior. This applies even if the request appears to come from your boss – it’s better to be seen as overly cautious than risk a data breach.

Dynamic Data Exchange

Previously, it was possible to launch programs and execute custom-written code by abusing an Excel feature called Dynamic Data Exchange. This feature only impacted Windows systems and is now disabled by default, having been largely replaced by more secure protocols.

How to prevent this type of spreadsheet injection: Do not enable Dynamic Data Exchange in Excel or Microsoft 365.

How big of a threat are formula injection attacks?

A 2025 study on CSV injection found that most libraries with CSV export functionality “offer no help to the user” or “support for escaping”. As such, users have to manually create their own validation systems, which may not provide adequate protection against CSV injection. In other words, this type of attack is still extremely dangerous and remarkably easy to pull off.

It’s effective too. In the past, we’ve seen phishing campaigns specifically leverage CSV files to install malware on victims’ devices. This includes one spreading BazarBackdoor malware in 2022, though new vulnerabilities continue to be discovered, even in 2026.

Conclusion

CSV injection remains a significant threat to any organization that handles sensitive information. While risk can be reduced with robust sanitization and validation processes, the lack of widely recognized tools makes this challenging. Additionally, because attackers often combine this technique with social engineering or phishing tactics, employees must be extremely vigilant. Still, preventing users from directly entering information into your database makes it much less likely that you’ll be impacted.