p PatchFirst

CVE-2025-55037

CVE-2025-55037

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote unauthenticated attacker if the settings are configured to construct messages from external sources.

CVSS 9.3 · Critical · EPSS 2.3% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • tkeasygui

    Versions
    • versions prior to v1.0.22: Affected

    No fix published

  • tkeasygui PyPI

    Versions
    • 0.1.0
    • 0.1.1
    • 0.1.2
    • 0.1.3
    • 0.1.4
    • 0.1.6
    • 0.2.1
    • 0.2.16
    • 0.2.19
    • 0.2.2
    • 0.2.20
    • 0.2.24
    • 0.2.27
    • 0.2.28
    • 0.2.29
    • 0.2.3
    • 0.2.30
    • 0.2.31
    • 0.2.35
    • 0.2.38
    • 0.2.4
    • 0.2.43
    • 0.2.44
    • 0.2.45
    • 0.2.46
    • 0.2.47
    • 0.2.48
    • 0.2.49
    • 0.2.55
    • 0.2.57
    • 0.2.63
    • 0.2.67
    • 0.2.68
    • 0.2.69
    • 0.2.71
    • 0.2.72
    • 0.2.73
    • 0.2.74
    • 0.2.75
    • 0.2.76
    • 0.2.77
    • 1.0.10
    • 1.0.11
    • 1.0.12
    • 1.0.13
    • 1.0.14
    • 1.0.16
    • 1.0.17
    • 1.0.18
    • 1.0.2
    • 1.0.20
    • 1.0.21
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    • 1.0.7
    • 1.0.8
    • 1.0.9
    Affected ranges
    • ECOSYSTEM: < 1.0.22

    Update to 1.0.22

Original sources

Check your server →