One-Line Security Fix: How an XLS Quote Escaping Bug in Dify Leaked Spreadsheet Data

A security researcher identified a CSV injection vulnerability in Dify, an open-source AI platform, where user-supplied cell values in the XLS spreadsheet parser were not properly quoted when written to CSV, allowing crafted values to inject additional rows or columns. The flaw was fixed with a one-line change replacing string concatenation with Python's csv module for proper escaping. The researcher noted that downstream consumers re-importing the exported data could be at risk of data injection into protected fields.

While auditing Dify an open-source AI platform , I found a one-line bug in the XLS spreadsheet parser. User-supplied cell values were not properly quoted when written to CSV, allowing specially crafted values to inject additional rows or columns. The original code: Vulnerable: no quote escaping line = ",".join str cell for cell in row A malicious cell value like "evil","data would break out of the CSV quoting and inject arbitrary columns. If this CSV was later imported by another process, it could inject data into protected fields. python Fixed: use csv module for proper escaping import csv import io output = io.StringIO writer = csv.writer output writer.writerow row line = output.getvalue CSV injection also called formula injection is a common vulnerability in apps that export data to spreadsheet formats. Even though the initial export might seem harmless, downstream consumers that re-import the data are at risk. The fix was a single line change — replacing string concatenation with the proper csv module — but the security impact was significant. Follow my bug bounty journey: @truongsontung https://github.com/truongsontung This post is part of my Autonomous Bug Bounty Hunter https://dev.to/t/pruongsontung?series=12345 series.