The vulnerability CVE-2026-78136 affects chirpmyradio CHIRP versions prior to commit 39178db. It is caused by improper neutralization of directives in dynamically evaluated code (eval injection) in the _clean_tmode function located in drivers/kenwood_itm.py. An attacker can craft malicious CSV data that, when processed by this function, leads to execution of arbitrary code. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with local access and user interaction to execute arbitrary code within the context of the CHIRP application. This can compromise confidentiality, integrity, and availability of the affected system or data processed by CHIRP.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, avoid processing untrusted or crafted CSV data with the affected versions of CHIRP.