EUVD-2026-37730
GHSA-v4jc-pm6r-3vj8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker-supplied SCXML reaches eval() with no auth or interaction when the loader is used, yielding full code execution in-process, so AV:N/AC:L/PR:N/UI:N and C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Blast Radius
ecosystem impact- 2 pypi packages depend on python-statemachine (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.0.0.
DescriptionCVE.org
Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted <data expr="..."> attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings through a call chain ending in Python's built-in eval() without sandboxing, enabling arbitrary code execution in the context of the hosting process.
Articles & Coverage 1
AnalysisAI
Remote code execution in python-statemachine 3.0.0 through 3.1.x allows attackers to run arbitrary Python in the host process by supplying a crafted SCXML document whose <data expr="..."> attributes are passed unsandboxed to eval() inside SCXMLProcessor. Reported by VulnCheck with publicly available exploit code and a vendor advisory (GHSA-v4jc-pm6r-3vj8); no public exploit identified at time of analysis as actively in the wild, and the flaw is not listed in CISA KEV.
Technical ContextAI
python-statemachine is a Python library implementing the W3C SCXML state-chart execution model. Its experimental SCXML loader (statemachine.io.scxml.SCXMLProcessor) parses .scxml XML documents and resolves data-model expressions such as <data expr="…"> by feeding the raw string into Python's built-in eval() with no sandbox or AST allow-list - a textbook CWE-95 'Improper Neutralization of Directives in Dynamically Evaluated Code' (eval injection). Any code reachable from the eval globals (os, subprocess, importlib) is therefore callable. The single affected CPE is cpe:2.3:a:fgmacedo:python-statemachine, and only the SCXML ingestion path is vulnerable; Python-defined StateMachine/StateChart objects do not touch eval.
RemediationAI
Vendor-released patch: upgrade to python-statemachine 3.2.0 or later (pip install --upgrade 'python-statemachine>=3.2.0'), which replaces the unsafe eval() path with a safe-by-default SCXML datamodel per GHSA-v4jc-pm6r-3vj8. Note that 3.2.0 drops Python 3.9 support and requires Python 3.10+; environments still on 3.9 should plan an interpreter upgrade rather than pinning to vulnerable 3.1.x. If immediate upgrade is impossible, stop calling SCXMLProcessor or parsing .scxml files from any source you do not fully control, validate/strip <data expr="…"> attributes from inbound documents before parsing, and isolate any SCXML-handling worker in a least-privilege sandbox (separate user, seccomp, no network egress) - these mitigations break legitimate dynamic SCXML data expressions, so document the functional loss.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-95 – Eval Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today