handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.

Affected: Packagist: handcraftedinthealps/goodby-csv

### Impact

goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.

### Patches

Has the problem been patched? What versions should users upgrade to?

The problem is patched with Version 1.4.3

### Workarounds

Patch `src/Goodby/CSV/Export/Standard/Collection /CallbackCollection.php`:

```diff + public function __wakeup() { + throw new \BadMethodCallException('Cannot unserialize ' . __CLASS__); + } ```

However, this is not directly exploitable; a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in goodby-csv.

### References _Are there any links users can visit to find out more?_