CVE-2025-55671 TkEasyGUI Affected by Uncontrolled Search Path Element Issue
An attacker can execute arbitrary code via an uncontrolled search path element in TkEasyGUI, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-55671?
CVE-2025-55671 is a high-severity code injection vulnerability in kujirahand TkEasyGUI, published on 5 Sep 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.
Weakness: CWE-427
Which versions are affected by CVE-2025-55671?
3 open source packages ship an affected version, including tkeasygui and TkEasyGUI.
| Package | Affected | Fixed in |
|---|---|---|
tkeasygui PyPI | All versions | 1.0.22 |
tkeasygui PyPI | All versions | 1.0.22 |
TkEasyGUI PyPI | All versions | 1.0.22 |
How do I fix CVE-2025-55671?
Upgrade tkeasygui to 1.0.22 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-55671 being exploited?
There is no known exploitation of CVE-2025-55671 in the wild and no public exploit code.
Sources
Also known as GHSA-ph2w-cx28-vhrq, PYSEC-2026-1968.