CVE-2026-78136

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

CVE-2026-78136

chirpmyradio CHIRP (a radio programming tool) is vulnerable to eval injection via crafted CSV data in the _clean_tmode function within drivers/kenwood_itm.py. This flaw allows arbitrary code execution when a user opens a maliciously crafted CSV file, as indicated by the associated research reposi...

CVE-2026-78136

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

EUVD-2026-64616

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

CVE-2026-78136

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

PT-2026-79749

Name of the Vulnerable Software and Affected Versions chirpmyradio CHIRP versions prior to 39178db Description An eval injection issue exists when processing crafted CSV data. This occurs within the clean tmode function located in the drivers/kenwood itm.py file. Eval injection is a flaw where an...

CVE-2026-78136: Improper Neutralization of Directives in Dynamically Evaluated Code

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in cleantmode in drivers/kenwooditm.py...

CVE-2026-61539

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

GHSA-X2RJ-828P-HX9M Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...

Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Summary Xinference used Python's unsafe eval function when parsing Llama3 tool-call output generated by a large language model. Because the model output can be influenced by attacker-controlled prompts sent to the chat completion API, a remote attacker can craft prompts that cause the model to...

EUVD-2026-64146

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-61539

Xinference (an inference API for open-source, speech, and multimodal models) versions 2.5.0 and earlier are vulnerable to remote code execution via unsafe use of Python's eval() in Llama3 tool-call parsing. An unauthenticated remote attacker can craft a prompt sent to /v1/chat/completions with a ...

CVE-2026-61539 Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval in xinference/model/llm/toolparsers/llama3toolparser.py and xinference/model/llm/utils.py. Requests to...

CVE-2026-41450

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

CVE-2026-41451

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

EUVD-2026-64011

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...