Description
Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `<data expr="...">` attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings through a call chain ending in Python's built-in eval() without sandboxing, enabling arbitrary code execution in the context of the hosting process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
fgmacedo python-statemachine
Default version status: affected
3.0.0 to < 3.2.0affected
pkg:pypi/python-statemachineReferences
- https://github.com/SaiTeja-Erukude/CVE-2026-47103-python-statemachine-rce ↗
- https://github.com/fgmacedo/python-statemachine/releases/tag/v3.2.0 ↗
- https://github.com/fgmacedo/python-statemachine/security/advisories/GHSA-v4jc-pm6r-3vj8 ↗
- https://www.vulncheck.com/advisories/python-statemachine-rce-via-scxml-eval-injection ↗