defusedcsv

What it is and what it does

Defusedcsv wraps Python's standard csv module to defend against CSV injection attacks—a vulnerability where malicious formulas in user-generated data can execute when a spreadsheet application opens the exported file. The library intercepts cells that begin with formula-triggering characters (@, +, -, =, |, %) and prepends an apostrophe to neutralize them; it also replaces pipe characters in those cells with escaped equivalents. The apostrophe remains invisible to end users in most spreadsheet software, making the defense transparent.

It is designed as a drop-in replacement: you swap `import csv` for `from defusedcsv import csv` and use the API identically. The library supports Python 3.9 to 3.13 and carries no external dependencies, making installation and integration straightforward. The trade-off is that the resulting CSV files are slightly altered—cells that would have triggered formulas are now safe but visually different in raw form.

Use it for:

• Exporting user-submitted survey or form data to CSV without risk of formula injection in recipient spreadsheets.
• Building a web application that generates downloadable CSV reports from untrusted user input.
• Protecting against accidental or deliberate CSV injection when aggregating data from multiple sources into a single export file.
• Ensuring compliance with security best practices when handling CSV export in multi-tenant SaaS platforms.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Defusedcsv is a drop-in replacement for Python's standard csv module that mitigates CSV injection attacks by escaping cells that start with formula-triggering characters.

Yes, if you export CSV files containing any user-generated data. The library is lightweight, has no dependencies, and solves a real attack surface with minimal code changes. The aging maintenance status (346 days since last release) is not a blocker for a stable, narrow-scope utility, but monitor the repository for any security disclosures. No known vulnerabilities are recorded.

Install

defusedcsv on PyPI

pip install defusedcsv

uv add defusedcsv

poetry add defusedcsv

Installing defusedcsv

Before you install

Low friction: pure Python wheel with no runtime dependencies. Maintenance is aging—last release was 346 days ago, though the repository remains active with a recent commit on 2025-09-03.

License in practice

Apache License 2.0 (permissive) places no restrictions on use or distribution; you may use this in commercial or proprietary projects without obligation to share modifications.

Quickstart

from defusedcsv import csv
import io

output = io.StringIO()
writer = csv.writer(output)
writer.writerow(['@formula', 'normal_data', '=SUM()'])
print(output.getvalue())

Verify before relying

• Whether the escaping strategy (prepending apostrophe, replacing pipe characters) is sufficient against all known CSV injection vectors or if newer attack patterns exist.
• Real-world compatibility with spreadsheet software versions beyond the implicit testing mentioned in the description.
• Whether the library's defense remains effective across all supported Python versions (3.9 to 3.13).

Package facts

Evidence: defusedcsv-3.0.0-py3-none-any.whl

Keywords: csv, injection, defuse, save

Tags

More Security packages