{"answers":{"affected":"2 open source packages ship an affected version, including handcraftedinthealps/goodby-csv.","exploited":"There is no known exploitation of CVE-2025-49597 in the wild and no public exploit code.","fix":"Upgrade handcraftedinthealps/goodby-csv to 1.4.3 or later.","what":"CVE-2025-49597 is a low-severity unsafe deserialization vulnerability in handcraftedinthealps goodby-csv, published on 13 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-49597 and fix it if it is affected.\n\nWhat it is: CVE-2025-49597 is a low-severity unsafe deserialization vulnerability in handcraftedinthealps goodby-csv, published on 13 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-49597 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- handcraftedinthealps/goodby-csv (Packagist): affected all versions; fixed in 1.4.3\n- handcraftedinthealps/goodby-csv (Packagist): affected all versions; fixed in 1.4.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-49597/ (Markdown: https://insights.sbomify.com/CVE-2025-49597/index.md)","id":"CVE-2025-49597","markdown":"https://insights.sbomify.com/CVE-2025-49597/index.md","name":"CVE-2025-49597","record":{"aliases":["GHSA-x3c7-22c8-prg7"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"PHP CSV library","requires_auth":"high_privilege","summary":"The goodby-csv library contains a gadget chain that enables remote code execution when used in applications with insecure deserialization vulnerabilities.","user_interaction":"not_required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":3.9,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-915","name":"Improperly Controlled Modification of Dynamically-Determined Object Attributes"}],"description":"handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called \"gadget chain\" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution","id":"CVE-2025-49597","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"deserialization","year":"2025"},"n_packages":2,"n_references":2,"next":{"headline":"conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing","id":"CVE-2025-49598"},"packages":[{"ecosystem":"Packagist","fixed":["1.4.3"],"introduced":["0"],"last_affected":[],"package":"handcraftedinthealps/goodby-csv","purl":null,"source":"GHSA-x3c7-22c8-prg7"},{"ecosystem":"Packagist","fixed":["1.4.3"],"introduced":["0"],"last_affected":[],"package":"handcraftedinthealps/goodby-csv","purl":"pkg:composer/handcraftedinthealps/goodby-csv","source":"GHSA-x3c7-22c8-prg7"}],"prev":{"headline":"MCP Inspector proxy server lacks authentication between the Inspector client and proxy","id":"CVE-2025-49596"},"products":["goodby-csv"],"published":"2025-06-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-06-23","vendors":["handcraftedinthealps"]},"summary":"The goodby-csv library contains a gadget chain that enables remote code execution when used in applications with insecure deserialization vulnerabilities.","url":"https://insights.sbomify.com/CVE-2025-49597/"}