An eval injection vulnerability in CHIRP prior to commit 39178db allows attackers to execute arbitrary code through malicious CSV files.

This is an Improper Neutralization of Directives in Dynamically Evaluated Code (CWE-95) vulnerability. The application fails to properly sanitize CSV input before processing it with an eval function, which can be triggered by an unauthenticated user if they are coerced into opening a malicious file.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host system with the privileges of the user running the application. Given the CVSS score of 7.8, this poses a significant risk to system integrity and confidentiality, potentially leading to a full system compromise or the exfiltration of sensitive configuration data.

Immediate Action: Update CHIRP to the version containing the fix, which is represented by commit 39178dbfc4fece083ab9ed20286d6ae3a91a718e or later.

Proactive Monitoring: Monitor system logs for unexpected child processes spawned by the CHIRP application, particularly those occurring immediately after importing or opening CSV files.

Compensating Controls: Exercise caution when opening CSV files from untrusted sources within the application until the software can be updated.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate attention to prevent potential code execution. Administrators should prioritize updating the CHIRP software to the patched version as soon as it is available to neutralize the risk of eval injection.