Why a plain CSV can execute formulas
CSV has no data types. When Excel or another spreadsheet opens it, the application decides whether each value is text, a number, a date, or a formula. User-controlled values that start with formula markers can therefore be evaluated when a person opens an export.
Safer handling steps
- Treat exports containing untrusted text as data, not trusted spreadsheets.
- Scan every field after parsing, including quoted fields.
- Flag values whose trimmed form starts with a formula marker.
- Prefix flagged values with an apostrophe before spreadsheet use.
- Review the repaired output because some legitimate formulas may intentionally begin with those characters.
What the free tool changes
The repair prefixes formula-like cells with an apostrophe and records the count in a downloadable JSON report. Processing stays in the browser. The tool reduces a common risk but is not a substitute for application-specific export validation or endpoint security.