diff --git a/app/views/api/v1/accounts/csat_survey_responses/download.csv.erb b/app/views/api/v1/accounts/csat_survey_responses/download.csv.erb
index ba17c175b..bd12a240c 100644
--- a/app/views/api/v1/accounts/csat_survey_responses/download.csv.erb
+++ b/app/views/api/v1/accounts/csat_survey_responses/download.csv.erb
@@ -11,7 +11,7 @@
   ]
   headers << I18n.t('reports.csat.headers.review_notes') if ChatwootApp.enterprise?
 -%>
-<%= CSV.generate_line(headers) -%>
+<%= CSVSafe.generate_line(headers) -%>
 <% @csat_survey_responses.each do |csat_response| %>
 <% assigned_agent = csat_response.assigned_agent %>
 <% contact = csat_response.contact %>
@@ -29,10 +29,10 @@
   ]
   row << csat_response.csat_review_notes if ChatwootApp.enterprise?
 -%>
-<%= CSV.generate_line(row).html_safe -%>
+<%= CSVSafe.generate_line(row).html_safe -%>
 <% end %>
 <%=
-  CSV.generate_line([
+  CSVSafe.generate_line([
     I18n.t(
       'reports.period',
       since: Date.strptime(params[:since], '%s'),
diff --git a/spec/controllers/api/v1/accounts/csat_survey_responses_controller_spec.rb b/spec/controllers/api/v1/accounts/csat_survey_responses_controller_spec.rb
index 10b81986d..3f14cf315 100644
--- a/spec/controllers/api/v1/accounts/csat_survey_responses_controller_spec.rb
+++ b/spec/controllers/api/v1/accounts/csat_survey_responses_controller_spec.rb
@@ -183,6 +183,18 @@ RSpec.describe 'CSAT Survey Responses API', type: :request do
         expect(content[1][1]).to eq '1'
         expect(content.length).to eq 3
       end
+
+      it 'neutralises formula-leading characters in the feedback column' do
+        create(:csat_survey_response, account: account, feedback_message: '=1+1', created_at: 1.day.ago)
+
+        get "/api/v1/accounts/#{account.id}/csat_survey_responses/download",
+            params: params,
+            headers: administrator.create_new_auth_token
+
+        expect(response).to have_http_status(:success)
+        injected = CSV.parse(response.body).map { |row| row[2] }.find { |value| value.to_s.include?('1+1') }
+        expect(injected).to start_with("'")
+      end
     end
   end
 end