Executive brief
CHIRP is an open-source radio programming tool used by amateur radio operators to configure wireless devices. A malicious radio configuration file (ITM or IMG format) containing crafted CSV data can trigger arbitrary code execution on a user's machine when opened. An attacker can deliver such a file via email or other means to gain complete control over the victim's computer.
Technical details
CHIRP's Kenwood ITM file format driver contains an eval injection vulnerability in the _clean_tmode() function within drivers/kenwood_itm.py. The vulnerable code directly passes unsanitized CSV field values (TXSIG and RXSIG fields) from an opened ITM or IMG file to Python's built-in eval() function without any type checking, allowlist validation, or sandboxing. An attacker can craft a malicious ITM or IMG file containing Python code in these fields (e.g., "__import__('os').system('calc')") which executes when the file is opened in CHIRP. No user interaction beyond opening the file is required. The fix was applied in commit 39178db and released in CHIRP version 20260821.
Affected products
- CHIRP CHIRP before 39178db (release 20260821)
Timeline
- 2026-08-17: disclosed: Vulnerability discovered
- 2026-08-17: disclosed: Maintainer emailed
- 2026-08-17: patched: Maintainer fixed the same day (commit 39178db)
- 2026-08-21: patched: Installer release 20260821 includes the fix
- 2026-08-23: advisory: CVE-2026-78136 issued