CVE-2026-78136: CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in chirpmyradio CHIRP

CVE-2026-78136 is an eval injection vulnerability in chirpmyradio CHIRP software versions prior to commit 39178db. The vulnerability arises from improper neutralization of directives in dynamically evaluated code (CWE-95) specifically in the _clean_tmode function in drivers/kenwood_itm.py. Crafted CSV input can exploit this flaw, potentially allowing an attacker to execute arbitrary code. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability with local attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation of this vulnerability can lead to arbitrary code execution via crafted CSV data, resulting in complete compromise of the affected system's confidentiality, integrity, and availability. The attack requires local access and user interaction but no privileges, making it a significant risk for users processing untrusted CSV files with the vulnerable CHIRP versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should avoid processing untrusted CSV data with affected versions until a patch or mitigation is released.