The CHIRP utility for radio configuration contains an eval statement that is executed when parsing CSV data. A specially crafted CSV file can inject arbitrary Python code through the _clean_tmode function in drivers/kenwood_itm.py. This form of code injection can lead to remote code execution on the host system where CHIRP runs. The weakness corresponds to improper code execution with CWE-95.

All publicly distributed releases of CHIRP prior to the commit identified by 39178db are affected. The vulnerability is present in the chirpmyradio CHIRP application, regardless of operating system, as the flaw resides in the Python source code that handles CSV input. Any deployment that still uses an older version of CHIRP is vulnerable.

The vulnerability receives a CVSS score of 7.8, indicating a high severity. Because the flaw depends on the processing of a CSV file, the attack vector is most likely local file import or possibly remote if the application accepts uploaded files. The EPSS score is not available, and the flaw is not currently listed in CISA’s KEV catalog, but the high CVSS and code‑execution nature warrant immediate remediation. An attacker who can supply a malicious CSV to a system running a vulnerable version of CHIRP could run arbitrary code with the permissions of the CHIRP process.