CVE-2025-49597

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49597
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49597.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-49597
Aliases
Published
2025-06-13T19:51:19.190Z
Modified
2026-04-02T12:51:29.859727Z
Severity
  • 3.9 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution
Details

handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49597.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-915"
    ]
}
References

Affected packages

Git / github.com/handcraftedinthealps/goodby-csv

Affected ranges

Type
GIT
Repo
https://github.com/handcraftedinthealps/goodby-csv
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
acd14c6ed85116bb2cb4da35ab62821e5cf54519

Affected versions

1.*
1.4.0
1.4.1
1.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49597.json"