diff --git a/misp_modules/modules/export_mod/threatStream_misp_export.py b/misp_modules/modules/export_mod/threatStream_misp_export.py
index 0ebc1be2..b3f35a63 100755
--- a/misp_modules/modules/export_mod/threatStream_misp_export.py
+++ b/misp_modules/modules/export_mod/threatStream_misp_export.py
@@ -50,6 +50,14 @@
 mispattributes = {"input": list(fieldmap.keys())}
 
 
+def sanitize_csv_value(value):
+    """Prefix values that could be interpreted as spreadsheet formulas to prevent CSV injection."""
+    value = str(value)
+    if value.startswith(("=", "+", "-", "@")):
+        value = "'" + value
+    return value
+
+
 def handler(q=False):
     """
     Convert a MISP query into a CSV file matching the ThreatStream Structured Import file format.
@@ -80,17 +88,17 @@ def handler(q=False):
                     for i, indicator in enumerate(indicators):
                         writer.writerow(
                             {
-                                "value": indicator,
+                                "value": sanitize_csv_value(indicator),
                                 "itype": ts_types[i],
-                                "tags": attribute["comment"],
+                                "tags": sanitize_csv_value(attribute["comment"]),
                             }
                         )
                 else:
                     writer.writerow(
                         {
                             "itype": fieldmap[attribute["type"]],
-                            "value": attribute["value"],
-                            "tags": attribute["comment"],
+                            "value": sanitize_csv_value(attribute["value"]),
+                            "tags": sanitize_csv_value(attribute["comment"]),
                         }
                     )
 
diff --git a/misp_modules/modules/export_mod/threat_connect_export.py b/misp_modules/modules/export_mod/threat_connect_export.py
index ea61ca66..696906de 100644
--- a/misp_modules/modules/export_mod/threat_connect_export.py
+++ b/misp_modules/modules/export_mod/threat_connect_export.py
@@ -56,6 +56,14 @@
 mispattributes = {"input": list(fieldmap.keys())}
 
 
+def sanitize_csv_value(value):
+    """Prefix values that could be interpreted as spreadsheet formulas to prevent CSV injection."""
+    value = str(value)
+    if value.startswith(("=", "+", "-", "@")):
+        value = "'" + value
+    return value
+
+
 def handler(q=False):
     """
     Convert a MISP query into a CSV file matching the ThreatConnect Structured Import file format.
@@ -90,18 +98,18 @@ def handler(q=False):
                         writer.writerow(
                             {
                                 "Type": tc_types[i],
-                                "Value": indicator,
+                                "Value": sanitize_csv_value(indicator),
                                 "Source": config["Default_Source"],
-                                "Description": attribute["comment"],
+                                "Description": sanitize_csv_value(attribute["comment"]),
                             }
                         )
                 else:
                     writer.writerow(
                         {
                             "Type": fieldmap[attribute["type"]],
-                            "Value": attribute["value"],
+                            "Value": sanitize_csv_value(attribute["value"]),
                             "Source": config["Default_Source"],
-                            "Description": attribute["comment"],
+                            "Description": sanitize_csv_value(attribute["comment"]),
                         }
                     )