📌 Key Takeaways
- ✓Spreadsheet software executes formulas if a cell begins with =, +, -, @, Tab (0x09), or CR (0x0D).
- ✓Attackers can inject malicious formulas into invoice descriptions, payee references, or customer names.
- ✓Unchecked payloads can trigger formula execution or macro dialogs when opened in Microsoft Excel.
- ✓The OWASP safe export policy neutralizes formula triggers by prepending a single quote (').
- ✓UtilityFinch automatically neutralizes all exported CSVs while preserving valid negative numbers.
1. What is CSV / Formula Injection (CWE-1236)?
Formula Injection (also known as CSV Injection or Spreadsheet Injection) occurs when an application exports untrusted user input into a CSV or spreadsheet file without proper sanitization.
When an accountant or manager downloads the CSV and opens it in Microsoft Excel, LibreOffice Calc, or Google Sheets, the spreadsheet engine automatically parses cells beginning with =, +, -, or @ as executable formulas rather than passive strings.
This allows attackers to exfiltrate private data, generate deceptive links via the HYPERLINK function, or invoke external data connections via Dynamic Data Exchange (DDE).
In vulnerable spreadsheet configurations, formulas starting with = or @ can prompt users to enable external data connections or leak cell data to external servers.
2. The OWASP Safe Neutralization Standard
The Open Web Application Security Project (OWASP) defines the industry standard for preventing CSV injection:
If any cell begins with =, +, -, @, a tab character (0x09), or a carriage return (0x0D), it must be prepended with a single quote (').
In spreadsheet engines, a leading single quote explicitly instructs the parser to treat the content as literal text. The quote itself is suppressed from visual display, rendering the payload completely inert.
| Raw Untrusted Cell | Vulnerability Type | Neutralized Output | Spreadsheet Behavior |
|---|---|---|---|
| =SUM(1+1)*DDE(...) | Formula Execution | '=SUM(1+1)*DDE(...) | Rendered as safe text string |
| @HYPERLINK("example.com") | Deceptive Link | '@HYPERLINK("example.com") | Disabled hyperlink |
| +447000000000 | Potential Formula | '+447000000000 | Safe phone number text |
| -15.50 (Numeric Amount) | Safe Numeric Value | -15.50 | Preserved as financial number |
3. UtilityFinch Safe Export Architecture
Many online tools naively sanitize CSVs by stripping plus and minus signs, which corrupts financial statements by turning negative debits into positive numbers.
UtilityFinch implements a context-aware sanitizer: strictly validated numeric literals (such as -15.50 or +250.00) in amount columns are preserved as numbers, while any formula-triggering characters in text columns (descriptions, memos, categories) are safely neutralized with a single quote.
All CSV processing runs locally in browser memory, providing both mathematical precision and bulletproof security.
Bank Statement CSV Cleaner
Clean, normalize dates and amounts, remove duplicate entries, and sanitize bank statement CSV exports safely in-browser.