Summary
User free-text (e.g. publisher notes) is written into exported spreadsheet cells. exceljs types them as text, which mitigates most risk, but a value beginning with = + - @ \t \r can still be interpreted as a formula by spreadsheet software on open (CSV/XLSX formula injection).
Remediation
Prefix exported cell values that start with = + - @ \t \r with a single quote (').
Severity
Low.
Source: internal security review (commit 0360e87, 2026-07-21).
Summary
User free-text (e.g. publisher
notes) is written into exported spreadsheet cells.exceljstypes them as text, which mitigates most risk, but a value beginning with= + - @ \t \rcan still be interpreted as a formula by spreadsheet software on open (CSV/XLSX formula injection).Remediation
Prefix exported cell values that start with
= + - @ \t \rwith a single quote (').Severity
Low.
Source: internal security review (commit
0360e87, 2026-07-21).