{"id":"CVE-2025-55671","aliases":["EUVD-2025-26896","GHSA-ph2w-cx28-vhrq","PYSEC-2026-1968"],"status":"published","title":"TkEasyGUI Affected by Uncontrolled Search Path Element Issue","description":"Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00164,"percentile":0.05671,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-427"],"published":"2025-09-05T05:24:45Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"PyPI","package":"tkeasygui","fixed_in":["1.0.22"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"tkeasygui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22"}]}]},{"source":"osv","ecosystem":"PyPI","package":"tkeasygui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.6","0.2.1","0.2.16","0.2.19","0.2.2","0.2.20","0.2.24","0.2.27","0.2.28","0.2.29","0.2.3","0.2.30","0.2.31","0.2.35","0.2.38","0.2.4","0.2.43","0.2.44","0.2.45","0.2.46","0.2.47","0.2.48","0.2.49","0.2.55","0.2.57","0.2.63","0.2.67","0.2.68","0.2.69","0.2.71","0.2.72","0.2.73","0.2.74","0.2.75","0.2.76","0.2.77","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.16","1.0.17","1.0.18","1.0.2","1.0.20","1.0.21","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"tkeasygui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.6","0.2.1","0.2.16","0.2.19","0.2.2","0.2.20","0.2.24","0.2.27","0.2.28","0.2.29","0.2.3","0.2.30","0.2.31","0.2.35","0.2.38","0.2.4","0.2.43","0.2.44","0.2.45","0.2.46","0.2.47","0.2.48","0.2.49","0.2.55","0.2.57","0.2.63","0.2.67","0.2.68","0.2.69","0.2.71","0.2.72","0.2.73","0.2.74","0.2.75","0.2.76","0.2.77","1.0.10","1.0.11","1.0.12","1.0.13","1.0.14","1.0.16","1.0.17","1.0.18","1.0.2","1.0.20","1.0.21","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9"]}],"products":[{"vendor":"kujirahand","product":"tkeasygui"}],"references":[{"url":"https://github.com/kujirahand/tkeasygui-python/releases/tag/v1.0.22","tags":["web"]},{"url":"https://jvn.jp/en/jp/JVN48739895/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55671","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN48739895","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ph2w-cx28-vhrq","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55671.json","tags":["advisory"]},{"url":"https://github.com/kujirahand/tkeasygui-python","tags":["package"]},{"url":"https://pypi.org/project/tkeasygui","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-55671","description":"Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.","status":"published","published":"2025-09-05T05:24:45.422Z","modified":"2025-09-05T13:45:51.932Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-26896","description":"Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.","status":"published","published":"2025-09-05T05:24:45Z","modified":"2025-09-05T13:45:51Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T20:31:46.9428Z"}],"ghsa":[{"id":"GHSA-ph2w-cx28-vhrq","title":"TkEasyGUI Affected by Uncontrolled Search Path Element Issue","description":"Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.","status":"published","published":"2025-09-05T06:30:29Z","modified":"2025-09-05T21:08:49Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:38:57.074217Z"}],"nvd":[{"id":"CVE-2025-55671","description":"Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.","status":"published","published":"2025-09-05T06:15:32.607Z","modified":"2026-06-17T09:41:59.223Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T14:11:27.145738Z"}],"osv":[{"id":"CVE-2025-55671","description":"Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.","status":"published","published":"2025-09-05T05:24:45.422Z","modified":"2026-10-28T02:30:58.750645474Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"GHSA-ph2w-cx28-vhrq","title":"TkEasyGUI Affected by Uncontrolled Search Path Element Issue","description":"Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.","status":"published","published":"2025-09-05T06:30:29Z","modified":"2026-07-07T17:56:55.017202497Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-427"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"PYSEC-2026-1968","title":"TkEasyGUI Affected by Uncontrolled Search Path Element Issue","description":"Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with the privilege of running the program.","status":"published","published":"2026-07-07T16:03:03.284369Z","modified":"2026-07-07T17:48:05.342233494Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}