PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-78136 chirpmyradio CVE debrief

CVE-2026-78136 is a high-severity vulnerability in the CHIRP software, with a CVSS score of 7.8. The vulnerability allows for eval injection via crafted CSV data in the _clean_tmode function of the drivers/kenwood_itm.py file. This issue was fixed in version 39178db. Users should assess their exposure, verify if their systems are affected, and apply the fix in version 39178db. The vulnerability exists in the CHIRP software, specifically in the drivers/kenwood_itm.py file, and can lead to high impact on confidentiality, integrity, and availability. Users of the CHIRP software, specifically those who use the kenwood_itm.py driver, should assess their exposure and verify if their has

Vendor
chirpmyradio
Product
CHIRP
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-23
Original CVE updated
2026-09-09
Advisory published
2026-08-23
Advisory updated
2026-09-09

Who should care

Users of the CHIRP software, specifically those who use the kenwood_itm.py driver, should assess their exposure and verify if their systems are affected. They should also verify if the fix in version 39178db has been applied.

Why it matters

CVE-2026-78136 is a high-severity vulnerability in the CHIRP software that allows for eval injection via crafted CSV data. Users should assess their exposure, verify if their systems are affected, and apply the fix in version 39178db.

  • Potential code execution through eval injection
  • Possible high impact on confidentiality, integrity, and availability
  • Verification of fix in version 39178db required

Technical summary

The vulnerability exists in the CHIRP software, specifically in the drivers/kenwood_itm.py file. The issue allows for eval injection via crafted CSV data in the _clean_tmode function. This can lead to high impact on confidentiality, integrity, and availability.

Defensive priority

High

Recommended defensive actions

  • Assess exposure by verifying if systems using CHIRP software are affected
  • Verify if the fix in version 39178db has been applied
  • Restrict input to trusted sources to prevent crafted CSV data injection

Evidence notes

The vulnerability exists in the CHIRP software, specifically in the drivers/kenwood_itm.py file. The issue allows for eval injection via crafted CSV data. The fix for this vulnerability is included in version 39178db.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-78136 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-78136

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-78136 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-78136

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.