Description
Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `<data expr="...">` attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings through a call chain ending in Python's built-in eval() without sandboxing, enabling arbitrary code execution in the context of the hosting process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fgmacedo | python-statemachine | 3.0.0 – < 3.2.0 | 3.2.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
SaiTeja-Erukude/CVE-2026-47103-python-statemachine-rce ★ 0 · Aug 15, 2026
Python StateMachine 3.0.0 < 3.2.0 RCE via unsafe SCXML <data expr> evaluation and Python eval() injection.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | python-statemachine | >= 3.0.0, < 3.2.0 | 3.2.0 | GHSA-v4jc-pm6r-3vj8 |
References
- Researcher Disclosure technical-description exploit
- python-statemachine 3.2.0 Release Notes release-notes
- GitHub Security Advisory (GHSA-v4jc-pm6r-3vj8) vendor-advisory
- https://www.vulncheck.com/advisories/python-statemachine-rce-via-scxml-eval-injection third-party-advisory