Severity
Medium — classic CSV-injection: org data authored by other Salesforce users executes in the admin's Excel.
What happens
escapeCsvValue only quotes for "", ',', \n, \r; the Excel path passes strings to SheetJS untouched. A text field containing =HYPERLINK("http://evil","click") or =cmd|' /C calc'!A0 is written verbatim and executes as a formula when the export opens in Excel. Verified live against the packaged 0.6.0 bundle: a record named =SUM(A1:A9) exports verbatim into CSV. Also applies to the Bulk upload CSV builder.
Evidence
src/ui/utils/csv.ts:9-16src/ui/utils/excel.ts (raw json_to_sheet)src/services/salesforce/bulk-api.ts:274
Suggested fix
Prefix cells matching /^[=+\-@\t\r]/ with ' (optionally behind a toggle, as some tools offer). Add tests.
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code + live harness verified).
Severity
Medium — classic CSV-injection: org data authored by other Salesforce users executes in the admin's Excel.
What happens
escapeCsvValueonly quotes for"", ',', \n, \r; the Excel path passes strings to SheetJS untouched. A text field containing=HYPERLINK("http://evil","click")or=cmd|' /C calc'!A0is written verbatim and executes as a formula when the export opens in Excel. Verified live against the packaged 0.6.0 bundle: a record named=SUM(A1:A9)exports verbatim into CSV. Also applies to the Bulk upload CSV builder.Evidence
src/ui/utils/csv.ts:9-16src/ui/utils/excel.ts(rawjson_to_sheet)src/services/salesforce/bulk-api.ts:274Suggested fix
Prefix cells matching
/^[=+\-@\t\r]/with'(optionally behind a toggle, as some tools offer). Add tests.Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code + live harness verified).