CVE-2026-78136

Published: Ago 23, 2026 Last Modified: Ago 23, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Access Control Integrity Availability Other Non-Repudiation
Potential Impacts:
Read Files Or Directories Read Application Data Bypass Protection Mechanism Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands Hide Activities
Applicable Platforms
Languages: Java, JavaScript, Python, Perl, PHP, Ruby, Interpreted
Technologies: AI/ML
Likelihood of Exploit: Medium
View CWE Details
https://github.com/cduram/CHIRP-CodeExecution_via_Malicious…
https://github.com/cduram/CHIRP-CodeExecution_via_Malicious_ImageFile
https://github.com/kk7ds/chirp/commit/39178dbfc4fece083ab9e…
https://github.com/kk7ds/chirp/commit/39178dbfc4fece083ab9ed20286d6ae3a91a718e