Test files › Structured data › formula-injection.csv
Sample CSV file
Cells beginning with =, +, -, @ and tab, which spreadsheet applications interpret as formulas. The payloads are non-destructive: they reference HYPERLINK and a harmless calculation.
↓ Download formula-injection.csv| Filename | formula-injection.csv |
| Format | CSV |
| Size | 357 bytes (357 bytes) |
| MIME type | text/csv; charset=utf-8 |
| SHA-256 | c591c3c65f09f7ce69b6b47558650baf9ad511d14df5c95e0fdd9977bcbf0d0f |
What this file catchesCSV export endpoints that write user-supplied data unescaped. When a victim opens the export in Excel or Sheets, the formula executes in their context. Correct mitigation is prefixing risky cells with a single quote or wrapping them.
Download & verify
curl -fsSL -o "formula-injection.csv" "https://files.hexaqa.com/csv/formula-injection.csv"
curl -fsSL "https://files.hexaqa.com/csv/formula-injection.csv" | sha256sum
# expect: c591c3c65f09f7ce69b6b47558650baf9ad511d14df5c95e0fdd9977bcbf0d0f