CVE-2025-55037: TkEasyGUI OS Command Injection Vulnerability
Summary
CVE-2025-55037: TkEasyGUI Vulnerable to OS Command Injection. Affects tkeasygui versions < 1.0.22. Fixed in 1.0.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TkEasyGUI is a Python package designed to facilitate the creation of graphical user interfaces (GUIs) in a simple and user-friendly manner. It allows developers to build applications with minimal code, providing essential features for input dialogs, message boxes, and other GUI elements. However, certain configurations of TkEasyGUI can lead to vulnerabilities, particularly when handling external input, making it susceptible to OS command injection attacks.
Vulnerability Detail
The vulnerability identified as CVE-2025-55037 is an OS Command Injection issue present in TkEasyGUI versions prior to 1.0.22. This flaw arises from improper neutralization of special elements used in OS commands, allowing a remote unauthenticated attacker to execute arbitrary OS commands if the application is configured to construct messages from external sources. The potential ramifications of this vulnerability are severe, as it could lead to unauthorized access, data breaches, or system compromise.
How To Fix
Latest published version: 1.0.45 as of 23 Oct 2026
pip install --upgrade "tkeasygui==1.0.45"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.22
This is the first release that contains the fix.
pip install --upgrade "tkeasygui==1.0.22"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid constructing messages from untrusted external sources until the package is updated. Additionally, consider implementing input validation and sanitization to mitigate the risk of command injection.
Conclusion
In summary, CVE-2025-55037 represents a critical OS command injection vulnerability in TkEasyGUI that can be exploited by remote attackers. It is imperative to update to version 1.0.22 or later to secure your application. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for tkeasygui →
FAQ
CVE-2025-55037 is a critical vulnerability in TkEasyGUI that allows for OS command injection due to improper handling of external input.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring installation.
Exploitation of this vulnerability can lead to unauthorized execution of OS commands, potentially compromising the system and exposing sensitive data.
Yes, the patch is available in TkEasyGUI version 1.0.22 and later. It is crucial to update to this version to mitigate the risk.
If immediate updating is not possible, avoid using external sources for constructing messages and implement input validation to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for tkeasygui.
