CVE-2026-47103-python-statemachine-rce

CVE-2026-47103: Python StateMachine Remote Code Execution via SCXML eval Injection Severity: Critical, CVSS 4.0 9.3 , CVSS 3.1 9.8 assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...

Python StateMachine 3.1.2 SCXML Expression Code Execution

Python StateMachine version 3.1.2 evaluates SCXML data expression attributes with Python eval, allowing arbitrary code execution when processing attacker-controlled SCXML. The proof of concept demonstrates this using a local marker file. https://packetstorm.news/download/235225...

Python StateMachine 3.1.2 Remote Code Execution

Python StateMachine 3.1.2 contains a code injection vulnerability in its SCXML processing functionality. The included proof of concept demonstrates code execution by writing a harmless marker file when the malicious SCXML datamodel expression is evaluated...

Exploit for Code Injection in Fgmacedo Python_Statemachine

CVE-2026-47103: Python StateMachine Remote Code Execution via...

Deserialization Of Untrusted Data

Spring Statemachine is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Kryo-based persistence backends deserializing persisted state-machine contexts without enforcing a class allowlist, which allows an attacker to provide malicious serialized data and potentially...

python-statemachine SCXML <data expr> Eval Injection

Summarypython-statemachine 3.1.2 evaluates attributes in SCXML documents using Python's eval. Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process. DetailsSCXMLProcessor.parsescxmlfile...

controlled-execution-system (>=0.1.25, <=0.1.31), wandelbots-nova (>=5.1.2, <=5.7.4) potentially affected by CVE-2026-47103 via python-statemachine (>=3.0.0, <=3.1.2)

python-statemachine PYPI version =3.0.0, =0.1.25, =5.1.2, =5.7.4 Source cves: CVE-2026-47103 Source advisory: OSV:PYSEC-2026-506...

PT-2026-53579

Summary python-statemachine 3.1.2 evaluates attributes in SCXML documents using Python's eval. Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process. Details SCXMLProcessor.parse scxml file...

GHSA-85QJ-F5WG-RWP9 Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

org.springframework.statemachine:spring-statemachine-cluster (>=3.2.0, <=3.2.1), org.springframework.statemachine:spring-statemachine-data-common (>=3.2.0, <=3.2.1) +10 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=3.2.0, <=3.2.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.1 Source cves: CVE-2026-41862 Source advisory: OSV:GHSA-85QJ-F5WG-RWP9https://vulners.com/osvghsa/OSV...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +13 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1 So...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +13 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1 So...

org.springframework.statemachine:spring-statemachine-cluster (>=3.2.0, <=3.2.1), org.springframework.statemachine:spring-statemachine-data-common (>=3.2.0, <=3.2.1) +10 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=3.2.0, <=3.2.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.2.1 Source cves: CVE-2026-41862 Source advisory: GHSA-85QJ-F5WG-RWP9https://vulners.com/github/GHSA-85QJ...

Spring Statemachine's Kryo-based persistence backends deserialize persisted state-machine contexts without enforcing a class allowlist

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +13 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-kryo (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-kryo MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1 So...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

EUVD-2026-38596

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...

CVE-2026-41862

Spring Statemachine's Kryo-based persistence backends JPA, MongoDB, Redis and ZooKeeper deserialise persisted state-machine contexts without enforcing a class allowlist CWE-502, deserialisation of untrusted data, which can lead to remote code execution inside the application JVM. Affected version...