[roberto]

First, there's no specification.

Second, this: http://georgemauer.net/2017/10/07/csv-injection.html

[brazzy]

Quote from the site you linked to: "So who’s fault is all of this anyways? Well it’s not the CSV format’s."

And what I wrote before is basically all you need for a specification. Yes, it sucks that there is no fixed one that everyone uses.