CSV files are plain text, but the programs that open them are not. A product name or description that starts with =, +, - or @ can be treated as a formula by spreadsheet applications when the file is opened — a security issue known as CSV formula injection. It sounds theoretical until you see it: a menu item named "=20% Off Special" opens in Excel and the cell tries to evaluate a formula. This guide explains the risk and how CSV Pilot protects your exports.
What formula injection is
Spreadsheets like Excel interpret cells that start with certain characters as formulas:
=SUM(A1:A9)— a formula+1+2— also treated as a formula in some applications-cmd— can be read as a command in older contexts@something— newer spreadsheet behavior
If a product description says "=20% off today", a spreadsheet opening the exported file may try to execute it as a formula. In the worst case, an attacker who controls a cell can craft a formula that reads files or reaches external services when someone opens the CSV — the spreadsheet becomes the attack surface.
Where the risk comes from
The danger is not your own data — it is data that came from somewhere untrusted:
- Product names or descriptions copied from vendor files
- User-submitted reviews or comments embedded in a catalog
- Menu items with symbols at the start of their names
- Imported data from another platform where the field was free text
Any of these could start with a formula character without meaning harm — or with intent. Either way, the exported file is the delivery vehicle.
How CSV Pilot protects your exports
When CSV Pilot generates or exports a CSV, values that begin with =, +, - or @ are sanitized so spreadsheet applications treat them as plain text, never as formulas. The visible value stays the same; only the dangerous interpretation is removed.
The same guard applies when you edit an existing file and re-export it: the exported version is safe to open in Excel or Google Sheets. This matters for catalog teams who share exports internally — the file a colleague opens is inert data.
What you can do yourself
- Validate before opening — prefer opening exports in CSV Pilot's preview, which parses the file as data, not formulas.
- Check vendor files — before importing a vendor's CSV into your own workflow, scan for cells starting with formula characters.
- Keep exports as data — treat a CSV as a data exchange format, not as a spreadsheet. If you open one in Excel, keep a copy of the original.
- Educate the team — anyone who opens catalog exports should know that unexpected formula prompts are a warning sign, not a quirk.
The broader data-safety picture
Formula injection is one of three CSV safety concerns. The other two:
- Encoding — UTF-8 keeps special characters intact and avoids garbled text.
- Prompt injection — content inside an uploaded CSV is treated as data, never as instructions. A product named "Ignore previous instructions" is just a product name; it cannot change what the tool does.
CSV formula injection is the kind of issue that never appears until someone opens the file in a spreadsheet — usually long after the import. Knowing the characters that trigger it, and using tools that sanitize exports, keeps your catalog data inert and safe.