Gophish prior to 0.11.0 allows the creation of CSV sheets that contain malicious content.
getgophish gophish