CVE-2026-78136High· 7.8▾ Twilightchirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.2%
Last analysed / modified upstream
chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-46946Critical· 9.8LangChain Experimental Eval Injection vulnerability
GHSA-77rh-m34w-rv36CriticalDuplicate Advisory: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
CVE-2026-78497High· 8.4JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval
CVE-2026-111865Medium· 5.3THU-MIG yoloe AutoBackend Model Loading autobackend.py eval eval injection
CVE-2026-111687Critical· 9.8WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint
CVE-2026-111391High· 8.1SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__