CVE-2025-55037 TkEasyGUI Vulnerable to OS Command Injection
Remote attackers can execute arbitrary OS commands in TkEasyGUI if configured to use external message sources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-55037?
CVE-2025-55037 is a critical command injection vulnerability in kujirahand TkEasyGUI, published on 5 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote unauthenticated attacker if the settings are configured to construct messages from external sources.
Weakness: CWE-78
Which versions are affected by CVE-2025-55037?
3 open source packages ship an affected version, including tkeasygui and TkEasyGUI.
| Package | Affected | Fixed in |
|---|---|---|
tkeasygui PyPI | All versions | 1.0.22 |
tkeasygui PyPI | All versions | 1.0.22 |
TkEasyGUI PyPI | All versions | 1.0.22 |
How do I fix CVE-2025-55037?
Upgrade tkeasygui to 1.0.22 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-55037 being exploited?
There is no known exploitation of CVE-2025-55037 in the wild and no public exploit code.
Sources
Also known as GHSA-hfrj-3w3g-jv32, PYSEC-2026-552.