CVE-2025-49597
handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution
Impact
### Impact goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. ### Patches Has the problem been patched? What versions should users upgrade to? The problem is patched with Version 1.4.3 ### Workarounds Patch `src/Goodby/CSV/Export/Standard/Collection /CallbackCollection.php`: ```diff + public function __wakeup() { + throw new \BadMethodCallException('Cannot unserialize ' . __CLASS__); + } ``` However, this is not directly exploitable; a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in goodby-csv. ### References _Are there any links users can visit to find out more?_
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | handcraftedinthealps/goodby-csv | < 1.4.3 | 1.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/handcraftedinthealps/goodby-csv/commit/acd14c6ed85116bb2cb4da35ab62821e5cf54519
- https://github.com/handcraftedinthealps/goodby-csv/security/advisories/GHSA-x3c7-22c8-prg7
- https://github.com/advisories/GHSA-x3c7-22c8-prg7
- https://nvd.nist.gov/vuln/detail/CVE-2025-49597