RockteMQ-AI commented on issue #1560: URL: https://github.com/apache/rocketmq-dashboard/issues/1560#issuecomment-5248866534
**Issue Evaluation** Category: `bug` | Status: **Confirmed** The reported issue is valid. The Consumer Group CSV export does not sanitize cell values that start with `=`, `+`, `-`, `@`, `\t`, or `\r`, which can be interpreted as formulas by spreadsheet applications (CSV injection / DDE attack). **Root Cause:** Exported CSV data is written without prefixing dangerous characters with a single quote or escaping them. **Severity:** Medium — CSV injection can execute arbitrary commands when the exported file is opened in Excel or similar applications. An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
