PYSEC-2026-506

Vulnerability from pysec - Published: 2026-06-29 11:50 - Updated: 2026-07-01 20:23
VLAI
Details

Summary

python-statemachine 3.1.2 evaluates <data expr="..."> attributes in SCXML documents using Python's eval(). Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process.

Details

SCXMLProcessor.parse_scxml_file() processes SCXML documents and evaluates <data> element expr attributes via the following call chain:

SCXMLProcessor.parse_scxml_file()
SCXMLProcessor.process_definition()
 create_datamodel_action_callable()
_create_dataitem_callable()
_eval()
eval()
 ```

`_eval()` calls Python's built-in `eval()` directly on the expression string without sandboxing or restriction.

### PoC

  1. Install: pip install python-statemachine==3.1.2

  2. Create an SCXML file containing:

  3. Run: SCXMLProcessor.parse_scxml_file(DATA_EXPR_CHART) SCXMLProcessor.start()

  4. During start(), reaches _eval(), which calls eval().

  5. Result: data_marker_before_start: False data_marker_after_start: True success: True ```

Impact

This is an eval injection vulnerability (CWE-95). Remote or local code execution depending on whether the consuming application accepts SCXML content from remote users, uploaded files, configuration, plugins, or other untrusted sources.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Impacted products
Name purl
python-statemachine pkg:pypi/python-statemachine
Aliases
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "python-statemachine",
        "purl": "pkg:pypi/python-statemachine"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0",
        "3.1.0",
        "3.1.1",
        "3.1.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47103",
    "GHSA-v4jc-pm6r-3vj8"
  ],
  "details": "### Summary\n\npython-statemachine 3.1.2 evaluates `\u003cdata expr=\"...\"\u003e` attributes in SCXML documents using Python\u0027s `eval()`. Any application that passes attacker-controlled SCXML content to `SCXMLProcessor` is vulnerable to arbitrary code execution in the context of the hosting process.\n\n### Details\n\n`SCXMLProcessor.parse_scxml_file()` processes SCXML documents and evaluates `\u003cdata\u003e` element `expr` attributes via the following call chain:\n\n```\nSCXMLProcessor.parse_scxml_file()\nSCXMLProcessor.process_definition()\n create_datamodel_action_callable()\n_create_dataitem_callable()\n_eval()\neval()\n ```\n\n`_eval()` calls Python\u0027s built-in `eval()` directly on the expression string without sandboxing or restriction.\n\n### PoC\n\n```\n1. Install:\n   pip install python-statemachine==3.1.2\n\n2. Create an SCXML file containing:\n   \u003cdata id=\"x\" expr=\"__import__(\u0027pathlib\u0027).Path(\u0027marker.txt\u0027).write_text(\u0027pwned\u0027)\"/\u003e\n\n 3. Run:\n   SCXMLProcessor.parse_scxml_file(DATA_EXPR_CHART)\n   SCXMLProcessor.start()\n \n4. During start(), \u003cdata expr\u003e reaches _eval(), which calls eval().\n\n5. Result:\n   data_marker_before_start: False\n   data_marker_after_start: True\n   success: True\n```\n\n### Impact\n\nThis is an eval injection vulnerability (CWE-95). Remote or local code execution depending on whether the consuming application accepts SCXML content from remote users, uploaded files, configuration, plugins, or other untrusted sources.",
  "id": "PYSEC-2026-506",
  "modified": "2026-07-01T20:23:03.302193Z",
  "published": "2026-06-29T11:50:52.079977Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fgmacedo/python-statemachine/security/advisories/GHSA-v4jc-pm6r-3vj8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47103"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fgmacedo/python-statemachine"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fgmacedo/python-statemachine/releases/tag/v3.2.0"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/python-statemachine-rce-via-scxml-eval-injection"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/python-statemachine"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-v4jc-pm6r-3vj8"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "python-statemachine SCXML \u003cdata expr\u003e Eval Injection"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.