Check a CSV for formula injection
Check a CSV for cells that start with the characters spreadsheets treat as commands, the classic CSV injection trick.
Working…
Questions people ask
- What is CSV formula injection?
- A trap inside plain data. A cell whose text starts with =, +, - or @ is re-read as a live instruction when the CSV opens in a spreadsheet, so a malicious export can make the reader fetch a URL, run a command or rewrite cells. The file never changed; the application trusted the cell. Checking a CSV for those prefixes before it travels is the point of this tool.
- Why is a negative number on the list?
- Because text and intent are different things. A cell holding -1.5 does start with a minus, and the scan counts it under minus-prefixed; the report calls this out as the most common false positive and shows the counts separately, so you can judge the minus findings against the real formula ones.
- The cell starts with a tab, then the command. Does that count?
- Yes, twice over. Tab or newline characters ahead of the risky character are an evasion attempt - the cell pretends not to start with what would be judged - and the report counts them in a separate evasion line. A run of ordinary spaces still leaves the risky character as the first thing a spreadsheet sees, so only the tab/CR/LF case is counted as evasion.
- Does the tool fix my file?
- No, deliberately. The report says plainly that detection is not remediation: knowing which cells carry risky prefixes is the audit, and changing your data (quoting, prefix-shifting, or stripping at export) is a separate decision you own. The tool never executes anything and never writes to your file.
- What happens to my files?
- The upload is removed as soon as processing finishes; the report stays downloadable for about 10 minutes, then it is deleted automatically.