First, there's no specification.
Second, this: http://georgemauer.net/2017/10/07/csv-injection.html
Second, this: http://georgemauer.net/2017/10/07/csv-injection.html
And what I wrote before is basically all you need for a specification. Yes, it sucks that there is no fixed one that everyone uses.