Catch CSV Injection Payloads Before They Execute

Security engineers, data analysts, and developers can paste any CSV and instantly see which cells contain dangerous formulas like =HYPERLINK, +SUM, -cmd, or @import. This client-side scanner turns a hidden spreadsheet risk into a clear, actionable report — no upload, no server, no waiting.

Results update live as you type — no button needed. The Example button fills a sample input.

Why use CSV Injection Detector?

Detects formula injection triggers including =, +, -, @, and pipe-based command payloads

Parses CSV into structured JSON so every cell can be inspected before import

Runs entirely in your browser — sensitive CSV data never leaves your device

Highlights suspicious cells such as =HYPERLINK, +SUM, and cmd|' /C calc' patterns

Works with Excel, Google Sheets, and internal tools that evaluate CSV formulas

FAQ

What is CSV injection?

CSV injection, also called formula injection, happens when a spreadsheet application treats a CSV cell beginning with =, +, -, or @ as a formula. Attackers can embed payloads like =HYPERLINK or +SUM to exfiltrate data or run commands when the file is opened.

How does this detector find dangerous cells?

It parses your CSV into JSON and exposes every cell so you can inspect values that start with formula triggers or contain command-style patterns such as cmd|' /C calc'. The structured output makes suspicious cells easy to spot and remove.

Is my CSV data uploaded to a server?

No. The scanner runs entirely in your browser. Your CSV content is processed locally and is never sent to or stored on any server.

Which spreadsheet apps are affected by CSV injection?

Microsoft Excel, Google Sheets, LibreOffice Calc, and many internal reporting tools can evaluate CSV formulas. Any application that opens CSV files and interprets leading =, +, -, or @ characters is potentially affected.

What should I do after detecting a payload?

Remove or escape the dangerous cell, prefix it with a single quote, or sanitize the CSV before import. Never open an untrusted CSV directly in a spreadsheet without scanning it first.

Example input

Try it with this sample — paste it into the box above:

Name,Email,Comment
Alice,alice@example.com,=HYPERLINK("http://evil.com","Click me")
Bob,bob@example.com,Normal text
Carol,carol@example.com,+SUM(1+1)*cmd|' /C calc'!A0

How to use CSV Injection Detector

  1. Enter or paste your data into the Paste CSV data box above.
  2. The result appears instantly in the Parsed CSV cells (JSON) box — everything runs in your browser, nothing is uploaded.
  3. Use Copy or Download to keep the result, or Example to load a sample first.

Related tools

🔧

CSV Join Online – Merge Two CSV Files by Key

Merge two CSV files online by a shared key. Paste both CSVs, pick the join key, and get a

🔧

CSV to JSON Converter — A Love Letter to CSV

Convert CSV to JSON instantly. A love letter to the CSV format: celebrate simplicity, unlo
🔧

CSV Mojibake Fixer - Fix Garbled CSV Encoding to JSON

Fix garbled CSV text caused by encoding mismatches like Shift_JIS, EUC-JP, or GBK. Paste m
🔧

CSV Viewer - View CSV Files Online as JSON

Free online CSV viewer. Paste CSV data and instantly preview it as structured JSON. Inspec
🔧

Excel Multi-Value Cell Splitter - Split Cells to Rows

Split multi-value Excel cells into separate rows or columns. Paste your table, choose a de
🔧

OOXML Excel Editor - Convert XLSX CSV to JSON Online

Free online OOXML Excel editor and spreadsheet converter. Paste your XLSX/CSV export and i

← All tools