PT-2026-50440 · Fgmacedo · Python-Statemachine

Vulncheck · Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-47103

X.com · Upwindmdr

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

🚨Critical - Python StateMachine RCE via SCXML eval Injection (CVE-2026-47103)

The python-statemachine library evaluates expressions from SCXML documents unsafely. Attacker-controlled attributes are passed through the SCXMLProcessor call chain into Python's built-in eval() with no sandboxing, so a malicious SCXML document supplied to an application that parses it results in arbitrary Python code execution in the context of the hosting process.

The flaw is remotely exploitable with low complexity and requires no privileges or user interaction, making any service that ingests untrusted SCXML directly exposed.

👉Upgrade to python-statemachine 3.2.0.

Fix

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-47103

Affected Products

Python-Statemachine

References · 4

• https://github.com/fgmacedo/python-statemachine/security/advisories/GHSA-v4jc-pm6r-3vj8 · Vendor Advisory
• https://github.com/fgmacedo/python-statemachine/releases/tag/v3.2.0 · Note
• https://vulncheck.com/advisories/python-statemachine-rce-via-scxml-eval-injection · Note
• https://twitter.com/UpwindMDR/status/2067303604126708159 · Twitter Post