GHSA-hfrj-3w3g-jv32

TkEasyGUI Vulnerable to OS Command Injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-55037

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	TkEasyGUI	< 1.0.22	1.0.22

Details

As written in the advisory (Markdown source, shown as plain text).

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote unauthenticated attacker if the settings are configured to construct messages from external sources.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-55037 advisory
https://github.com/kujirahand/tkeasygui-python package
https://github.com/kujirahand/tkeasygui-python/releases/tag/v1.0.22 web
https://jvn.jp/en/jp/JVN48739895 web