A critical vulnerability, tracked as NotCVE-2026-0013, has been discovered in the Kenwood ITM file format driver of CHIRP, a widely used open-source tool for programming amateur radios. The flaw is an eval injection vulnerability occurring because the application passes attacker-controlled CSV fields directly to Python's built-in eval() function without prior validation. By persuading a user to open a crafted radio file (.itm or .img), an attacker can execute arbitrary Python code with the privileges of the victim user.
The vulnerability is located in the ITMRadio._clean_tmode() function within chirp/drivers/kenwood_itm.py. It specifically targets the TXSIG and RXSIG fields, which the driver incorrectly assumes will only contain float values. Because the driver is part of the stock distribution and the file-load process requires no confirmation before execution, the threat is significant for users of affected builds. Users are urged to update to version chirp-next-20260821 or later, where the dangerous eval() calls have been replaced with a secure parsing mechanism.
Top comments (0)