«Live PoC verified 2026-04-30 against a stock FacturaScripts master at "127.0.0.1:8081". A low-privilege user ("lowpriv") created a customer with "nombre = "=SUM(1+1)*cmd|/c calc!A1"". An admin then exported "ListCliente" to CSV via "?action=export&option=CSV". The downloaded file contains the raw payload as the first cell of the "nombre" column, with no leading single quote and no escape. Excel and LibreOffice will execute the formula on open, including DDE invocations such as "=cmd|'/c calc'!A1" that spawn arbitrary processes on the admin workstation.» "Core/Lib/Export/CSVExport.php::writeData()" wraps every cell in the configured delimiter (""") and concatenates without inspecting the first character of the value. Spreadsheet applications interpret a cell that starts with "=", "+", "-", "@", "\t", or "\r" as a formula. Because FacturaScripts only sanitises HTML metacharacters ("< > " '") on save via "Tools::noHtml()" ("Core/Tools.php:45"), the formula prefix characters survive untouched all the way to the export. The downstream consumer is the admin who triggered the export, giving the attacker a reliable handoff: low-priv user plants a payload in any text field that ships in the default list export, admin downloads the CSV (all normal billing/sales/purchasing workflow), and the admin's spreadsheet client runs the formula in the admin's local context.