Skip to content

[Security] Prefix formula-trigger characters in exported spreadsheet cells #297

Description

@mindsers

Summary

User free-text (e.g. publisher notes) is written into exported spreadsheet cells. exceljs types them as text, which mitigates most risk, but a value beginning with = + - @ \t \r can still be interpreted as a formula by spreadsheet software on open (CSV/XLSX formula injection).

Remediation

Prefix exported cell values that start with = + - @ \t \r with a single quote (').

Severity

Low.


Source: internal security review (commit 0360e87, 2026-07-21).

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status
    Wishlist

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions