Mycelgrid Guide
What Is CSV Formula Injection?
Understand why spreadsheet-compatible exports can turn untrusted text into formulas, and why a formula guard is a scoped mitigation rather than a universal guarantee.
What CSV formula injection means
Formula injection occurs when untrusted text in a spreadsheet-compatible export is later interpreted by a spreadsheet application as a formula instead of plain data.
The interpreter creates the risk
CSV itself is text. The security behavior appears when a downstream application imports cells and gives some values formula semantics. Impact varies by spreadsheet, configuration, and user interaction.
Risky prefixes are not a universal checklist
Characters such as =, +, -, and @ are commonly relevant, but import paths and cell parsing differ. Tabs, carriage returns, quoting, and delimiters can also affect how text reaches a cell.
What the JSON to CSV Converter guards
With Formula guard enabled, the JSON to CSV Converter prefixes an apostrophe when guarded text begins with =, +, -, @, tab, or carriage return. The current converter applies that path to ordinary string cells, pipe-joined array text, and cleaned or renamed headers.
CSV quoting solves a different problem
CSV quoting protects field boundaries and embedded delimiters, quotes, or line breaks. A correctly quoted field may still be interpreted as a formula by spreadsheet software. Syntax correctness and formula neutralization are separate concerns.
How to review an export safely
Identify the actual destination application, test representative risky values, keep the original source, and treat formula-injection defense as a security requirement in workflows that handle untrusted data.
Apply the guard when you export
Convert your JSON to CSV, review the preview, and use Formula guard when untrusted text may be opened in spreadsheet software.
Convert JSON to CSV