Python StateMachine 3.1.2 SCXML Expression Code Execution

Python StateMachine version 3.1.2 evaluates SCXML data expression attributes with Python eval, allowing arbitrary code execution when processing attacker-controlled SCXML. The proof of concept demonstrates this using a local marker file. https://packetstorm.news/download/235225...