CVE-2026-47103-python-statemachine-rce

CVE-2026-47103: Python StateMachine Remote Code Execution via SCXML eval Injection Severity: Critical, CVSS 4.0 9.3 , CVSS 3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

Python StateMachine 3.1.2 Remote Code Execution

Python StateMachine 3.1.2 contains a code injection vulnerability in its SCXML processing functionality. The included proof of concept demonstrates code execution by writing a harmless marker file when the malicious SCXML datamodel expression is evaluated...

Exploit for Code Injection in Fgmacedo Python_Statemachine

CVE-2026-47103: Python StateMachine Remote Code Execution via...

python-statemachine SCXML <data expr> Eval Injection

Summarypython-statemachine 3.1.2 evaluates attributes in SCXML documents using Python's eval. Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process. DetailsSCXMLProcessor.parsescxmlfile...

PT-2026-53579

Summary python-statemachine 3.1.2 evaluates attributes in SCXML documents using Python's eval. Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process. Details SCXMLProcessor.parse scxml file...

python-statemachine SCXML <data expr> Eval Injection

Summary python-statemachine 3.1.2 evaluates attributes in SCXML documents using Python's eval. Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process. Details SCXMLProcessor.parsescxmlfile...

EUVD-2026-37730

python-statemachine SCXML Eval Injection...

Eval Injection

Overview python-statemachine is a Python Finite State Machines made easy. Affected versions of this package are vulnerable to Eval Injection via the SCXMLProcessor.parsescxmlfile process. An attacker can execute arbitrary code in the context of the hosting process by supplying a crafted SCXML...

controlled-execution-system (>=0.1.25, <=0.1.31), wandelbots-nova (>=5.1.2, <=5.7.4) potentially affected by CVE-2026-47103 via python-statemachine (>=3.0.0, <=3.1.2)

python-statemachine PYPI version =3.0.0, =0.1.25, =5.1.2, =5.7.4 Source cves: CVE-2026-47103 Source advisory: SNYK:PYTHON-PYTHONSTATEMACHINE-17675195...

controlled-execution-system (>=0.1.25, <=0.1.31), wandelbots-nova (>=5.1.2, <=5.7.4) potentially affected by CVE-2026-47103 via python-statemachine (>=3.0.0, <=3.1.2)

python-statemachine PYPI version =3.0.0, =0.1.25, =5.1.2, =5.7.4 Source cves: CVE-2026-47103 Source advisory: OSV:GHSA-V4JC-PM6R-3VJ8...

CVE-2026-47103

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted "" attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strin...

CVE-2026-47103 Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings...

CVE-2026-47103 Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings...

CVE-2026-47103

Python StateMachine 3.0.0 before 3.2.0 has a remote code execution flaw: crafted SCXML documents with are unsafely evaluated via eval() in the SCXMLProcessor, enabling arbitrary code execution in the hosting process. Affected versions are 3.0.0 up to (but not including) 3.2.0. The CVSS metrics i...

CVE-2026-47103: Improper Neutralization of Directives in Dynamically Evaluated Code

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings...

PT-2026-50440

Name of the Vulnerable Software and Affected Versions Python StateMachine versions 3.0.0 through 3.1.x Description An issue exists where the library evaluates expressions from SCXML documents unsafely. The SCXMLProcessor passes attacker-controlled expression strings from attributes through a call...