Quote-escaping bug in Dify's XLS parser let crafted cells inject CSV rows and columns

What happened

A security researcher auditing Dify, the open-source platform for building AI applications, found a one-line flaw in the way it converts uploaded XLS spreadsheets to CSV. According to a write-up published on dev.to, the conversion code assembled each output row by joining the string form of the cell values with commas — no quoting, no escaping. Because user-controlled cell contents were serialized verbatim, a value containing double quotes could terminate its own field early and manufacture fields that do not correspond to any real column.

How the injection works

CSV has rules for exactly this situation: a field containing a comma, a quote, or a newline gets wrapped in double quotes, and a literal quote inside the field is written twice. Skip those rules and the consumer's parser becomes the attack surface. In the researcher's example, a cell whose content is arranged like two quoted fields is enough to split one logical value into several apparent ones, and crafted values can likewise introduce extra rows. The damage is done downstream: if the generated CSV is later imported by another process, the injected fields can land in slots the importer treats as protected, populating or overwriting them.

The dev.to post frames the bug as an instance of CSV injection, also known as formula injection — the family of vulnerabilities in which data exported to a spreadsheet format carries structure or active content that a later consumer acts on. The better-known variant involves cells beginning with characters that spreadsheet applications interpret as formula starters; the Dify case is a structural variant in which the injection targets the CSV record itself rather than a formula engine.

The fix

The patch swaps hand-rolled string concatenation for Python's standard csv module. Each row is handed to a csv writer backed by an in-memory buffer, and the resulting line — correctly quoted and escaped — is what gets written out. The csv module applies the quoting rules the original code lacked: fields that need delimiters get them, and embedded quote characters are doubled so a value stays a single value no matter what it contains. In the researcher's telling, a change of roughly one line closes a meaningful data-leakage and injection path.

What the post leaves open

The write-up does not name the affected Dify versions, cite a CVE, or confirm that the fix has been merged upstream. It also describes the exploitation scenario generically — a downstream process re-importing the CSV — rather than demonstrating an attack against a specific Dify deployment. Anyone running Dify should treat the detail as a reason to check their own version and export paths rather than as a confirmed, weaponized disclosure.

Why it matters

Export and conversion code is a trust boundary, and it is routinely written as if it weren't. AI platforms like Dify ingest untrusted documents — spreadsheets are a standard knowledge-base format — so any step that re-serializes that content has to assume cell values are hostile structure, not just text. The failure mode here is also the cheap kind to prevent: Python ships a correct CSV serializer in its standard library, equivalents exist in most languages, and hand-rolling comma joins is a choice rather than a necessity. Finally, the find is a small argument for independent auditing of open-source AI tooling — a self-directed bug bounty effort surfaced a quoting bug that a feature-focused review would likely have read as harmless.