#**CSV Injection in shared passwords leads to complete Private Vault Exfiltration**

Summary

On March 18, 2025 we received a submission to our Bug Bounty program via HackerOne about an attack scenario that can lead to exfiltrating all exported vault contents. In order to exploit this scenario an attacker must have all the following in place:

1 - Share a vault with the target user on the target account, 2- Save a malicious payload with a specific spreadsheet formula, 3- Convince, or wait for, the target user to export their vault contents to CSV, and 4 - Convince, or wait for, the target user to open the exported CSV into a spreadsheet app.

This attack-scenario is possible due to a vulnerability known as “CSV Injection” when using the 1Password Export Account feature. In order to prevent potential data loss and ensure feature usability, we have determined we will not address the issue. Instead, we set the following guidelines for determining when it makes sense for us to protect against CSV Injections:

“When a spreadsheet is used for data interchange (e.g.; vault or item data exports which can be imported) then we will not escape the characters which runs the risk of causing data integrity issues. In cases where an export is specifically for the purposes of being viewed in a spreadsheet program (e.g.; usage and member list exports) we’ll consider it an issue."

CSV is a data format, one we have implemented in accordance with RFC 4180. It is spreadsheet software choosing to open these CSV and execute formulas that is not acting with the RFC in mind. In fact, the CSV format RFC itself, when discussing security considerations, states: "CSV files contain passive text data that should not pose any risks."

We must also keep in mind the intent of the 1Password Export account feature. The feature is specifically in place to allow users to correctly export their passwords for import into other password managers that are not 1Password. Therefore it would not be considered acceptable by users for us to interfere with their ability to import their passwords into other password managers, or potentially corrupting their data in the process.

Lastly, we're actively participating with several other password managers on a more secure credential exchange format in collaboration with the FIDO Alliance. Please read more about that effort in our blog.