defusedcsv

library3.0.0pypypi✓ verified 27d ago

defusedcsv is a Python library (version 3.0.0) that acts as a drop-in replacement for the standard library's `csv` module, specifically designed to mitigate CSV injection attacks. It works by sanitizing output, prepending an apostrophe to cells that start with potentially malicious characters like `=`, `+`, `-`, `@`, `|`, or `%`, and escaping `|` characters within these cells. This prevents spreadsheet software (like MS Excel or LibreOffice) from interpreting the cell content as a formula. The library's release cadence appears to be infrequent, with the latest version published to PyPI on September 2, 2025.

serialization auth-security http-networking

pip install defusedcsv

github ↗package ↗

INSTALL

IMPORT

SIG · DEFUSEDCSV

defusedcsv

serializationpythonv3.0.0

Install

1.7s avg

Import

—

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v3.0.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 17.8MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.7s · import 0.000s · 18MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

csv

✓ from defusedcsv import csv

✗ import csv

The library is designed as a drop-in replacement; replace `import csv` with `from defusedcsv import csv`.

This quickstart demonstrates how to use `defusedcsv` as a drop-in replacement for the standard `csv` module. It shows how potentially malicious spreadsheet formulas are automatically sanitized by prepending an apostrophe and escaping pipe characters, preventing execution when opened in spreadsheet software.

from defusedcsv import csv import io # Prepare an in-memory CSV output stream output = io.StringIO() writer = csv.writer(output) # Write header and rows, including potentially malicious payloads writer.writerow(['ID', 'Name', 'Notes']) writer.writerow(['1', 'Alice', 'Safe note']) writer.writerow(['2', 'Bob', '=1+1']) writer.writerow(['3', 'Charlie', '@SUM(A1:A2)']) writer.writerow(['4', 'David', '|cmd /C calc!A1']) # ' | ' is escaped, and the cell is prefixed with an apostrophe # Get the sanitized CSV data sanitized_csv_data = output.getvalue() print("--- Sanitized CSV Output (as seen in file) ---") print(sanitized_csv_data) # Example of reading the sanitized CSV back (shows raw content) input_data = io.StringIO(sanitized_csv_data) reader = csv.reader(input_data) print("\n--- Reading Sanitized CSV ---") headers = next(reader) print(f"Headers: {headers}") for row in reader: print(f"Row: {row}") # Expected output for the problematic cells (when viewed programmatically): # ['2', 'Bob', "'=1+1"] # ['3', 'Charlie', "'@SUM(A1:A2)"] # ['4', 'David', "'\\|cmd /C calc!A1"]

Debug

Known issues

breakingThe primary function of `defusedcsv` is to modify CSV cell content to prevent injection attacks. This means the output CSV files will not be byte-for-byte identical to those produced by the standard `csv` module if malicious-looking data is present. Systems expecting exact, untransformed CSV output (e.g., for cryptographic hashing or strict format validation) may break.

fix

Ensure downstream systems are aware of and can handle the modifications made by `defusedcsv` (prepending apostrophes, escaping pipe characters). If exact original data is required, `defusedcsv` is not suitable.

affects: All versions

gotchaThe library explicitly states it's tested with Python 3.9 to 3.13. While it might work on other Python 3 versions, explicit support is not guaranteed, which could lead to unexpected behavior or incompatibilities.

fix

Ensure your project runs on Python versions 3.9 through 3.13. If you must use other versions, thorough testing is recommended.

affects: <3.9, >3.13

gotchaThe sanitization only addresses CSV injection for spreadsheet software. It does not validate or sanitize other forms of potentially malicious data within the CSV (e.g., malformed data, incorrect types, or general parsing errors) that could exploit other vulnerabilities or cause issues in different downstream processing systems.

fix

Implement comprehensive data validation and sanitization at all input and output points of your application, not relying solely on `defusedcsv` for all security or data integrity concerns.

affects: All versions

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'defusedcsv'

The 'defusedcsv' package is not installed in the Python environment.

fix

Install the package using pip: 'pip install defusedcsv'.

ImportError: cannot import name 'csv' from 'defusedcsv'

Incorrect import statement; 'defusedcsv' does not have a 'csv' submodule.

fix

Use the correct import: 'import defusedcsv as csv'.

TypeError: 'module' object is not callable

Attempting to call 'defusedcsv' directly as a function, which is incorrect.

fix

Use 'defusedcsv.reader()' or 'defusedcsv.writer()' instead of calling 'defusedcsv' directly.

AttributeError: module 'defusedcsv' has no attribute 'DictReader'

The 'defusedcsv' module does not provide a 'DictReader' class.

fix

Use 'defusedcsv.reader()' and handle rows as dictionaries manually.

ValueError: I/O operation on closed file.

Attempting to read or write to a CSV file after the file has been closed.

fix

Ensure the file is open during the entire read/write operation, possibly using a 'with' statement to manage the file context.

Upgrade

Version history

3.0.0latest on PyPI · released Sep 2, 2025

Audit

Dependencies

No dependency data recorded yet.

Agent activity

44 hits · last 30 days

node

Amazon

Bingbot

OpenAI (training)

Resources

githubhttps://github.com/raphaelm/defusedcsv ↗

packagehttps://pypi.org/project/defusedcsv/ ↗