CVE-2025-55671: TkEasyGUI Uncontrolled Search Path Element Vulnerability
Summary
CVE-2025-55671: TkEasyGUI Affected by Uncontrolled Search Path Element Issue. Affects tkeasygui versions < 1.0.22. Fixed in 1.0.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TkEasyGUI is a Python package that provides a simple interface for creating graphical user interfaces (GUIs) using the Tkinter library. It is designed to make GUI development easier for Python developers by offering a straightforward API and various built-in components. However, versions prior to 1.0.22 are vulnerable to an uncontrolled search path element issue, which can lead to security risks.
Vulnerability Detail
The vulnerability in TkEasyGUI arises from an uncontrolled search path element, which allows an attacker to manipulate the search path for dynamic libraries. This can lead to arbitrary code execution with the privileges of the running program. If exploited, this vulnerability can compromise the integrity and confidentiality of the system, potentially allowing unauthorized access to sensitive data or system resources.
How To Fix
Minimum fixed version
1.0.22
This is the first release that contains the fix.
pip install --upgrade "tkeasygui==1.0.22"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using TkEasyGUI until you have updated to the fixed version. Additionally, ensure that your application does not load untrusted libraries or files that could be exploited through this vulnerability.
Conclusion
In summary, CVE-2025-55671 is a significant vulnerability in TkEasyGUI that can lead to arbitrary code execution. Users are strongly advised to update to version 1.0.22 or later to mitigate the risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tkeasygui →
FAQ
CVE-2025-55671 is a vulnerability in TkEasyGUI that allows for arbitrary code execution due to an uncontrolled search path element.
All versions of TkEasyGUI prior to 1.0.22 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary code execution, compromising the security of the system and potentially allowing unauthorized access to sensitive information.
The CVSS score for this vulnerability is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tkeasygui.
