Comma Separated Vulnerabilities
The really infuriating thing about this report is the message these terrible applications give to users.  "Links to other files?" And the inquiry about whether those "links" should be "updated?"  That's a ridiculous, terrible, message to express "remote code execution."  Just as bad is "automatic update of links."The hell?  If I were reading this (as a sophisticated user who isn't a security expert), I'd just assume there was some kind of weird document embedding thing going on.  Not that "link to other file" meant "RUN ARBITRARY APPLICATIONS AND PROBABLY EXECUTE ARBITRARY CODE."Even the warning about "To access this data Excel needs to start another application" is incredibly deceptive. The data in a CSV is perfectly damn accessible without Excel opening anything else.  It ought to say "to execute the commands embedded in this data, Excel needs to start another application," so that people bloody well know that they're not just viewing data but they're actually doing something.Horrible, horrible, horrible communication.