PT-2026-50440 · Fgmacedo · Python-Statemachine

Vulncheck · Publicado 2026-06-17 · Atualizado 2026-06-17 · CVE-2026-47103

X.com · Upwindmdr

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

🚨Critical - Python StateMachine RCE via SCXML eval Injection (CVE-2026-47103)

The python-statemachine library evaluates expressions from SCXML documents unsafely. Attacker-controlled attributes are passed through the SCXMLProcessor call chain into Python's built-in eval() with no sandboxing, so a malicious SCXML document supplied to an application that parses it results in arbitrary Python code execution in the context of the hosting process.

The flaw is remotely exploitable with low complexity and requires no privileges or user interaction, making any service that ingests untrusted SCXML directly exposed.

👉Upgrade to python-statemachine 3.2.0.

Correção

RCE

Eval Injection

Enumeração de Fraquezas

CWE-95

Identificadores relacionados

CVE-2026-47103

Produtos afetados

Python-Statemachine

Referências · 4

• https://github.com/fgmacedo/python-statemachine/releases/tag/v3.2.0 · Nota
• https://github.com/fgmacedo/python-statemachine/security/advisories/GHSA-v4jc-pm6r-3vj8 · Aviso do Fabricante
• https://vulncheck.com/advisories/python-statemachine-rce-via-scxml-eval-injection · Nota
• https://twitter.com/UpwindMDR/status/2067303604126708159 · Publicação no Twitter