EUVD-2026-64616
GHSA-6rmm-3cfr-7939
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based attack requires local file open (AV:L, UI:R); no attacker privileges needed (PR:N); full arbitrary code execution yields C:H/I:H/A:H with no scope change.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.
AnalysisAI
Eval injection in chirpmyradio CHIRP's Kenwood ITM driver allows arbitrary Python code execution when a user opens a specially crafted CSV file. The vulnerable _clean_tmode function in drivers/kenwood_itm.py passes untrusted TXSIG and RXSIG CSV column values directly to Python's built-in eval() without sanitization, confirmed by the upstream commit diff. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user to actively import a crafted CSV file using CHIRP's Kenwood ITM driver - specifically, a file containing a malicious Python expression in the TXSIG or RXSIG columns processed by `_clean_tmode` in `drivers/kenwood_itm.py`. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H accurately reflects the file-based local attack model: an attacker must deliver a crafted CSV and induce a user to import it, making this a social-engineering-dependent scenario rather than a remotely automatable exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a CHIRP CSV file with a malicious Python expression embedded in the TXSIG or RXSIG column (e.g., `__import__('os').system('...')`), then distributes it on a ham radio forum or via direct message as a legitimate-looking frequency file. When the victim imports the file through CHIRP's Kenwood ITM driver, `eval()` executes the embedded expression with the privileges of the CHIRP process. … |
| Remediation | Update CHIRP to a build that incorporates commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e or any later commit; verify the installed build's commit hash against this anchor since no specific tagged release version is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all users within your organization running CHIRP software and distribute a security alert warning against opening CSV files from untrusted sources; simultaneously, audit your environment for any suspicious CSV files that may have been opened. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-95 – Eval Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today