CVE-2026-78136

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

Score

CVSS 3.1 7.8 High

Status

Deferred - cve@mitre.org

Published

2026-08-23

Last modified

2026-10-12

Weaknesses

CWE-95

Affected products

• Chirp (Chirpmyradio)

References

• https://github.com/cduram/CHIRP-CodeExecution_via_Malicious_ImageFile
• https://github.com/kk7ds/chirp/commit/39178dbfc4fece083ab9ed20286d6ae3a91a718e