Description

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-23T01:17:20.143Z",
  "pubdate": "2026-08-23T01:17:20.143Z",
  "executiveSummary": "An evaluation injection vulnerability exists in chirpmyradio CHIRP prior to commit 39178db, specifically within the Kenwood radio configuration driver. The flaw arises due to the unsafe handling and processing of crafted comma-separated value (CSV) data during import operations. The vulnerability type is classified as improper control of generation of code, commonly known as eval injection, which allows attackers to execute arbitrary Python code within the context of the running application.\nThe impact of this vulnerability is severe, as successful exploitation enables remote or local code execution on the host system running the affected CHIRP software. This compromises the integrity and confidentiality of the underlying operating system and user data. The affected product is CHIRP in versions prior to 39178db, impacting systems utilizing the Kenwood driver component.\nRisk implications include potential full system compromise depending on the privileges of the user executing the application. Attacker capabilities require the ability to craft malicious CSV data and entice a user to import the file into the vulnerable software. Exploitation requirements mandate user interaction, specifically the action of opening or importing a specially crafted CSV file containing malicious payloads designed to leverage the vulnerable parsing logic.",
  "technicalDetails": "The root cause of the vulnerability resides in the _clean_tmode function located within the drivers/kenwood_itm.py file of the CHIRP codebase. During the parsing and sanitization of CSV data associated with Kenwood radio configurations, input strings are handled in an insecure manner that permits the evaluation of dynamic code constructs.\nThe vulnerable component is the Kenwood radio driver parsing logic, specifically the _clean_tmode function responsible for cleaning tone mode parameters from imported tabular data. Affected versions comprise all CHIRP installations prior to commit 39178db.\nExploitation occurs when a user imports a maliciously crafted CSV file containing specially constructed data strings into the CHIRP application. The attack flow initiates when the application reads the file rows and passes the untrusted input values to the _clean_tmode function. Because the input is not adequately sanitized or validated before being processed, the malicious payload is passed into an evaluation context, resulting in the execution of arbitrary Python code.\nRegarding authentication and privilege requirements, the vulnerability does not inherently require network authentication, as it functions locally via file parsing; however, successful execution depends on the local user privileges associated with the running instance of CHIRP. The payload behavior executes within the security context of the user running the application, inheriting their read and write permissions to the local file system and operating environment.\nThe post-exploitation impact includes arbitrary command execution, potential lateral movement, access to sensitive user files, and manipulation of system resources depending on the privileges granted to the CHIRP process. Network exposure is primarily indirect, relying on the vector used to deliver the malicious CSV file to the victim, such as malicious email attachments or untrusted repository downloads."
}