Executive brief
Python StateMachine is a library used to build and manage complex logic flows in applications. A security flaw in how it handles certain configuration files (SCXML) allows an attacker to run unauthorized commands on the server. This could lead to a full system takeover, data theft, or service disruption if the application processes files from untrusted sources.
Technical details
An eval injection vulnerability (CWE-95) exists in the SCXMLProcessor component of python-statemachine. The vulnerability is rooted in the `_eval()` function, which passes attacker-controlled strings from the `expr` attribute of `<data>` elements directly to Python's built-in `eval()` function without sandboxing. An attacker who can provide a malicious SCXML file to be parsed by `SCXMLProcessor.parse_scxml_file()` or `parse_scxml()` can achieve arbitrary code execution in the context of the hosting process. This issue was introduced in version 3.0.0 and is fixed in version 3.2.0 by implementing a restricted AST-based allowlist for expression evaluation.
Affected products
- fgmacedo python-statemachine >= 3.0.0, < 3.2.0
Timeline
- 2026-06-17: disclosed
- 2026-06-17: patched: Fixed in version 3.2.0
- 2026-06-17: advisory