CVE-2026-78136 - chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data

Back Back to CVE browser

HIGH

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data

Published Aug 23, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.21%

Description

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

Affected products

Vendor Chirpmyradio Product Chirp Default
unaffected
- Version
  0
  Status
  affected
  Constraints

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Chirpmyradio

Chirp

unaffected

Version	Status	Constraints
0	affected

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-95

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64616		Advisory
https://github.com/cduram/CHIRP-CodeExecution_via_Malicious_ImageFile
https://github.com/kk7ds/chirp/commit/39178dbfc4fece083ab9ed20286d6ae3a91a718e

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 23, 2026

Updated Aug 24, 2026

Reserved Aug 23, 2026

Link CVE-2026-78136

CISA Vulnrichment

Updated Aug 24, 2026

NVD

Status Deferred

Modified Sep 9, 2026

Link CVE-2026-78136

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-78136

ENISA EUVD

Assigner mitre

Published Aug 23, 2026

Updated Aug 24, 2026

Exploited since n/a

Link EUVD-2026-64616

EUVD-2026-64616