Fix CSV security flaw