PT-2025-25443 · Unknown · Goodby-Csv

Mcdruid · Published 2025-06-13 · Updated 2025-06-16 · CVE-2025-49597

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions goodby-csv versions prior to 1.4.3

Description The issue concerns an insecure deserialization vulnerability in the goodby-csv library, which can be used as part of a "gadget chain" to achieve remote code execution if an application deserializes untrusted data due to another vulnerability. This presents no direct threat but is a vector that can be exploited.

Recommendations For versions prior to 1.4.3, update to version 1.4.3 to resolve the issue. As a temporary workaround, consider restricting the use of the goodby-csv library in applications that deserialize untrusted data to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2025-49597

GHSA-X3C7-22C8-PRG7

Affected Products

Goodby-Csv

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49597.json · Exploit
• https://osv.dev/vulnerability/GHSA-x3c7-22c8-prg7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49597 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49597 · Vendor Advisory
• https://github.com/handcraftedinthealps/goodby-csv · Note
• https://github.com/handcraftedinthealps/goodby-csv/commit/acd14c6ed85116bb2cb4da35ab62821e5cf54519 · Note
• https://github.com/handcraftedinthealps/goodby-csv/security/advisories/GHSA-x3c7-22c8-prg7 · Note
• https://twitter.com/SecAideInfo/status/1934555779538792793 · Twitter Post
• https://twitter.com/CVEnew/status/1933619734240469161 · Twitter Post
• https://t.me/cvetracker/26215 · Telegram Post