What’s Vulnerable › Vulnerabilities

CVE-2025-49597: handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution

• Severity: low (CVSS 3.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-06-13 · updated 2026-06-17
• Weakness: CWE-915

Description

handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.

Affected products

• handcraftedinthealps goodby-csv: before 1.4.3

References

• https://github.com/handcraftedinthealps/goodby-csv/commit/acd14c6ed85116bb2cb4da35ab62821e5cf54519
• https://github.com/handcraftedinthealps/goodby-csv/security/advisories/GHSA-x3c7-22c8-prg7

Get alerted when CVE-2025-49597 or the next vulnerability affects your stack