Chirp
Monthly
Eval injection in chirpmyradio CHIRP's Kenwood ITM driver allows arbitrary Python code execution when a user opens a specially crafted CSV file. The vulnerable `_clean_tmode` function in `drivers/kenwood_itm.py` passes untrusted TXSIG and RXSIG CSV column values directly to Python's built-in `eval()` without sanitization, confirmed by the upstream commit diff. A proof-of-concept repository exists publicly, though no active exploitation is confirmed in CISA KEV. All CHIRP builds prior to commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e are affected.
Eval injection in chirpmyradio CHIRP's Kenwood ITM driver allows arbitrary Python code execution when a user opens a specially crafted CSV file. The vulnerable `_clean_tmode` function in `drivers/kenwood_itm.py` passes untrusted TXSIG and RXSIG CSV column values directly to Python's built-in `eval()` without sanitization, confirmed by the upstream commit diff. A proof-of-concept repository exists publicly, though no active exploitation is confirmed in CISA KEV. All CHIRP builds prior to commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e are affected.