CVE-2026-47103
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
A remote code execution vulnerability in Python StateMachine versions 3.0.0 before 3.2.0 allows attackers to execute arbitrary code by supplying malicious SCXML documents with crafted `<data expr="...">` attributes evaluated unsafely. The flaw enables arbitrary code execution in the context of the hosting process.
Risk Assessment
The risk for the organization includes potential system compromise, data theft, or lateral movement within the network, as the vulnerability allows unauthenticated remote code execution.
Recommendation
Immediately upgrade Python StateMachine to version 3.2.0 or later, which fixes this vulnerability. Avoid processing untrusted SCXML documents.
Original NVD description (English source)
Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `<data expr="...">` attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings through a call chain ending in Python's built-in eval() without sandboxing, enabling arbitrary code execution in the context of the hosting process.