CVE-2026-78136
Received Received - Intake

CSV Injection in CHIRP via Malicious CSV Data

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: MITRE

Description
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-78136
EUVD
EUVD-2026-64616

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78136 is an arbitrary code execution vulnerability in CHIRP, an open-source ham radio programming tool. The issue occurs in the Kenwood ITM driver where CSV field values are passed directly to Python's eval() function without validation. This allows attackers to execute malicious code if a user opens a specially crafted file. The vulnerability affects versions up to chirp-next-20260814 and was fixed by replacing eval() with proper parsing functions.

Detection Guidance

To detect this vulnerability, check if you are running a vulnerable version of CHIRP (up to chirp-next-20260814). Inspect CSV files opened in CHIRP for suspicious TXSIG or RXSIG values that may contain Python code. Review logs for unexpected program executions after opening files.

Impact Analysis

If you use CHIRP software, an attacker could trick you into opening a malicious file that executes arbitrary commands on your system. This could allow them to run programs, access sensitive data, or take control of your computer. The attack requires user interaction (opening a file) but no special privileges.

Compliance Impact

This vulnerability allows arbitrary code execution via malicious CSV files, which could lead to unauthorized data access, modification, or exfiltration. For GDPR, this could result in violations of data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information if the software is used in healthcare settings. The lack of input validation in the Kenwood ITM driver exacerbates these risks by enabling attackers to execute commands with user privileges.

Mitigation Strategies

Immediately update CHIRP to the latest version (after 39178db). Avoid opening CHIRP files from untrusted sources. Disable Python eval() usage in CHIRP drivers if possible. Monitor system activity for unusual processes after file operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78136. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart