{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security"}],"enrichment":{"capability":"Defusedcsv is a drop-in replacement for Python's standard csv module that mitigates CSV injection attacks by escaping cells that start with formula-triggering characters.","skillfed_tags":["csv-injection","data-export","security-hardening"],"use_cases":["Exporting user-submitted survey or form data to CSV without risk of formula injection in recipient spreadsheets.","Building a web application that generates downloadable CSV reports from untrusted user input.","Protecting against accidental or deliberate CSV injection when aggregating data from multiple sources into a single export file.","Ensuring compliance with security best practices when handling CSV export in multi-tenant SaaS platforms."],"what_it_does":"Defusedcsv wraps Python's standard csv module to defend against CSV injection attacks\u2014a vulnerability where malicious formulas in user-generated data can execute when a spreadsheet application opens the exported file. The library intercepts cells that begin with formula-triggering characters (@, +, -, =, |, %) and prepends an apostrophe to neutralize them; it also replaces pipe characters in those cells with escaped equivalents. The apostrophe remains invisible to end users in most spreadsheet software, making the defense transparent.\n\nIt is designed as a drop-in replacement: you swap `import csv` for `from defusedcsv import csv` and use the API identically. The library supports Python 3.9 to 3.13 and carries no external dependencies, making installation and integration straightforward. The trade-off is that the resulting CSV files are slightly altered\u2014cells that would have triggered formulas are now safe but visually different in raw form.","worth_installing":"Yes, if you export CSV files containing any user-generated data. The library is lightweight, has no dependencies, and solves a real attack surface with minimal code changes. The aging maintenance status (346 days since last release) is not a blocker for a stable, narrow-scope utility, but monitor the repository for any security disclosures. No known vulnerabilities are recorded."},"id":"defusedcsv","links":{"html":"https://skillfed.io/packages/defusedcsv","md":"https://skillfed.io/packages/defusedcsv.md","pypi":"https://pypi.org/project/defusedcsv/"},"maintenance":{"status":"aging"},"meta":{"latest_release":"2025-09-02","license_spdx":null,"license_treatment":"permissive","name":"defusedcsv","python_support":"unspecified","summary":"Drop-in replacement for Python's CSV library that tries to mitigate CSV injection attacks"},"popularity":{"monthly_downloads":1473625,"position":3864,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"3.0.0"}