On the first attack vector: Google Security has a nice post about it [0] and why they do not consider it a valid threat. This is their reasoning: >CSV files ar

On the first attack vector: Google Security has a nice post about it [0] and why they do not consider it a valid threat. This is their reasoning: >CSV files are just text files (the format is defined in RFC 4180) and evaluating formulas is a behavior of only a subset of the applications opening them - it's rather a side effect of the CSV format and not a vulnerability in our products which can export user-created CSVs. This issue should mitigated by the application which would be importing/interpreting data from an external source, as Microsoft Excel does (for example) by showing a warning. In other words, the proper fix should be applied when opening the CSV files, rather then when creating them. [0]: https://sites.google.com/site/bughunteruniversity/nonvuln/csv-excel-formula-injection https://sites.google.com/site/bughunteruniversity/nonvuln/cs... Their policy makes it sound like that the second vulnerability should indeed be fixed in Google Sheets itself (it is the one opening the file, after all)