Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

python-statemachine

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.3PyPIAmendedPublished

    python-statemachine SCXML Eval Injection

    CVE-2026-47103 · GHSA-v4jc-pm6r-3vj8

    Affected
    • PyPI python-statemachine >= 3.0.0, < 3.2.0
    Fixed in
    3.2.0· Vendor fix available
    Issue
    python-statemachine 3.1.2 evaluates <data expr="..." attributes in SCXML documents using Python's eval(). Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process. Details SCXMLProcessor.parsescxmlfile() processes SCXML documents and evaluates <data element expr attributes via the following call chain: eval() calls Python's built-in eval() directly on the expression string without sandboxing or restriction. PoC Impact This is an eval injection vulnerability (CWE-95). Remote or local code execution depending on whether the consuming application accepts SCXML content from remote users, uploaded files, configuration, plugins, or other untrusted sources.

    Recommended action: Upgrade to 3.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →