CVE-2025-49597 handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution
The goodby-csv library contains a gadget chain that enables remote code execution when used in applications with insecure deserialization vulnerabilities.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-49597?
CVE-2025-49597 is a low-severity unsafe deserialization vulnerability in handcraftedinthealps goodby-csv, published on 13 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.
Weakness: CWE-915
Which versions are affected by CVE-2025-49597?
2 open source packages ship an affected version, including handcraftedinthealps/goodby-csv.
| Package | Affected | Fixed in |
|---|---|---|
handcraftedinthealps/goodby-csv Packagist | All versions | 1.4.3 |
handcraftedinthealps/goodby-csv Packagist | All versions | 1.4.3 |
How do I fix CVE-2025-49597?
Upgrade handcraftedinthealps/goodby-csv to 1.4.3 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-49597 being exploited?
There is no known exploitation of CVE-2025-49597 in the wild and no public exploit code.
Sources
Also known as GHSA-x3c7-22c8-prg7.