I am working with a system that allows users to upload CSV files, that are downloaded by other users.
The system validates (amongst other things) that all CSV files can be parsed by an RFC 4180 compliant parser, and are valid UTF-8. It ensures that when files are downloaded, they have
Content-Type: text/csv; charset=utf-8, and
Content-Disposition: attachment; filename="download.csv".
A concern has been raised that the system could be used to transmit malware or malicious code.
Are there any known mechanisms where a malicious CSV file could cause code to be executed by the recipient? If so, is there any further validation that would reduce the risk posed?