Spreadsheet exports need formula-injection controls at the data boundary

Spreadsheet exports need formula-injection controls at the data boundary A CSV export can become an active document when someone opens it in a spreadsheet. Cells beginning with characters such as = , + , - , or @ may be interpreted as formulas. If the value came from a service request, a user profile, or an external feed, opening the file can execute a formula in the recipient's spreadsheet…