How it was found

Dear Weblate bug bounty team,

Summary

The new filter can be bypassed using: %0A-3+3+cmd|' /C calc'!D2.

text = "%0A-3+3+cmd|' /C calc'!D2"
def csv_filter_bypass():
    if text and text[0] in ('=', '+', '-', '@'):
        return "'" + text
return text

How can this be fixed?

You need to escape and detect more characters as follows:

text = "%0A-3+3+cmd|' /C calc'!D2"
def csv_filter_fix():
    if text and text[0] in ('=', '+', '-', '@', '|', '%'):
        text = text.replace("|", "\|")
        return "'" + text + "'"
return text

You can compare your results with the following demonstration:

text = "%0A-3+3+cmd|' /C calc'!D2"

def csv_filter_bypass():
    if text and text[0] in ('=', '+', '-', '@'):
        return "'" + text
    return text

def csv_filter_fix():
    if text and text[0] in ('=', '+', '-', '@', '|', '%'):
        text = text.replace("|", "\|")
        return "'" + text + "'"
    return text

csv_filter_bypass()
csv_filter_fix()

Best regards, Ed