https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 07:47:51 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2025-49597 <p>handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called &#34;gadget chain&#34; presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.</p> <p>handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called &#34;gadget chain&#34; presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2025-49597 https://vulnerability.circl.lu/vuln/ghsa-x3c7-22c8-prg7 <p><strong>Affected:</strong> Packagist: handcraftedinthealps/goodby-csv</p> <p>### Impact</p> <p>goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called &#34;gadget chain&#34; presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.</p> <p>### Patches</p> <p>Has the problem been patched? What versions should users upgrade to?</p> <p>The problem is patched with Version 1.4.3</p> <p>### Workarounds</p> <p>Patch `src/Goodby/CSV/Export/Standard/Collection /CallbackCollection.php`:</p> <p>```diff + public function __wakeup() { + throw new \BadMethodCallException(&#39;Cannot unserialize &#39; . __CLASS__); + } ```</p> <p>However, this is not directly exploitable; a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in goodby-csv.</p> <p>### References _Are there any links users can visit to find out more?_</p> <p><strong>Affected:</strong> Packagist: handcraftedinthealps/goodby-csv</p> <p>### Impact</p> <p>goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called &#34;gadget chain&#34; presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability.</p> <p>### Patches</p> <p>Has the problem been patched? What versions should users upgrade to?</p> <p>The problem is patched with Version 1.4.3</p> <p>### Workarounds</p> <p>Patch `src/Goodby/CSV/Export/Standard/Collection /CallbackCollection.php`:</p> <p>```diff + public function __wakeup() { + throw new \BadMethodCallException(&#39;Cannot unserialize &#39; . __CLASS__); + } ```</p> <p>However, this is not directly exploitable; a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in goodby-csv.</p> <p>### References _Are there any links users can visit to find out more?_</p> https://vulnerability.circl.lu/vuln/ghsa-x3c7-22c8-prg7