[Terr_]

Exfiltration is merely one of the issues.

The other is that an attacker can sneak something in that arbitrarily rewrites your spreadsheet. Triggers could be on content, or on a pre-planned attack time across many instances. Impacts could be subtly-flawed conclusions, or coarser "it stopped working and the deadline is looming" sabotage.

"Yeah boss, I sent out the checks to every vendor listed in the spreadsheet, what's wrong?"

[bpt3]

The potential issues are innumerable, which is why this breathless "vulnerability" report is pointless.

It's like someone writing a threat report on a car about an individual crash. Did you know cars can cause damage if you're not careful using them?