AIKIDO-2026-11016

TL;DR

Spree's CSV export models write customer- and admin-facing fields straight into CSV rows without neutralizing spreadsheet formula characters. Before the fix, an attacker who registers as a customer could place values starting with =, +, -, @, tab, or newline into name, email, address, or phone fields, and those values execute as formulas when an administrator opens the exported file in Excel or LibreOffice Calc. The injected formulas can exfiltrate other cell contents from the open spreadsheet or trigger OS command execution via Dynamic Data Exchange in vulnerable spreadsheet configurations. The patch routes every exported row through a new Spree::CSV::FormulaSanitizer that prefixes risky cells with an apostrophe so the spreadsheet treats them as text.