---
id: defusedcsv
version: "3.0.0"
license: Apache License 2.0
license_treatment: permissive
maintenance: aging
---

# defusedcsv — Drop-in replacement for Python's CSV library that tries to mitigate CSV injection attacks

License: permissive · Maintenance: aging · Downloads: 1.5M/mo

## What it is and what it does

Defusedcsv wraps Python's standard csv module to defend against CSV injection attacks—a vulnerability where malicious formulas in user-generated data can execute when a spreadsheet application opens the exported file. The library intercepts cells that begin with formula-triggering characters (@, +, -, =, |, %) and prepends an apostrophe to neutralize them; it also replaces pipe characters in those cells with escaped equivalents. The apostrophe remains invisible to end users in most spreadsheet software, making the defense transparent.

It is designed as a drop-in replacement: you swap `import csv` for `from defusedcsv import csv` and use the API identically. The library supports Python 3.9 to 3.13 and carries no external dependencies, making installation and integration straightforward. The trade-off is that the resulting CSV files are slightly altered—cells that would have triggered formulas are now safe but visually different in raw form.

Use it for:

- Exporting user-submitted survey or form data to CSV without risk of formula injection in recipient spreadsheets.
- Building a web application that generates downloadable CSV reports from untrusted user input.
- Protecting against accidental or deliberate CSV injection when aggregating data from multiple sources into a single export file.
- Ensuring compliance with security best practices when handling CSV export in multi-tenant SaaS platforms.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Defusedcsv is a drop-in replacement for Python's standard csv module that mitigates CSV injection attacks by escaping cells that start with formula-triggering characters.

Yes, if you export CSV files containing any user-generated data. The library is lightweight, has no dependencies, and solves a real attack surface with minimal code changes. The aging maintenance status (346 days since last release) is not a blocker for a stable, narrow-scope utility, but monitor the repository for any security disclosures. No known vulnerabilities are recorded.

## Install

pip install defusedcsv
uv add defusedcsv
poetry add defusedcsv

## Installing defusedcsv

Before you install: Low friction: pure Python wheel with no runtime dependencies. Maintenance is aging—last release was 346 days ago, though the repository remains active with a recent commit on 2025-09-03.

License in practice: Apache License 2.0 (permissive) places no restrictions on use or distribution; you may use this in commercial or proprietary projects without obligation to share modifications.

Quickstart:

from defusedcsv import csv
import io

output = io.StringIO()
writer = csv.writer(output)
writer.writerow(['@formula', 'normal_data', '=SUM()'])
print(output.getvalue())

Verify before relying:

- Whether the escaping strategy (prepending apostrophe, replacing pipe characters) is sufficient against all known CSV injection vectors or if newer attack patterns exist.
- Real-world compatibility with spreadsheet software versions beyond the implicit testing mentioned in the description.
- Whether the library's defense remains effective across all supported Python versions (3.9 to 3.13).

## Package facts

- License: Apache License 2.0 (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: aging
- Downloads: 1.5M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

csv injection prevention, safe csv export, defuse csv attacks, csv formula injection, secure csv writer, excel injection protection, csv cell escaping, csv-injection, data-export, security-hardening

[View on SkillFed](https://skillfed.io/packages/defusedcsv) · [View on PyPI](https://pypi.org/project/defusedcsv/)