CVE-2025-49597CWE-915

handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution

Low · published June 13, 2025

CVSS v3.1
3.9
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.

The record
Technical detail
CVSS v3.1
3.9 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.2th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2025-06-13T19:51Z
EPSS history
Timeline
  • 13 JUN 19:51Z
    handcraftedinthealps goodby-csv Potential Gadget Chain allowing Remote Code Execution
    cvelistv5