Python StateMachine 3.x processes SCXML documents that include <data expr="..."> attributes. In affected versions, the expression string is passed directly to Python's eval() without sanitization. This allows an attacker to embed arbitrary Python code in a malicious SCXML file, leading to remote code execution in the context of the hosting application. The weakness is an unsafe expression evaluation, mapped to CWE‑95.

The vulnerability exists in the open‑source Python library python‑statemachine maintained by fgmacedo. Users who are running versions 3.0.0 through 3.1.x are affected. Versions 3.2.0 and later mitigate the flaw.

The CVSS score is 9.3 (Critical), reflecting complete loss of confidentiality, integrity, and availability. EPSS is less than 1%, indicating the current exploitation probability is very low, but the lack of a KEV listing means no published exploit is known. The primary attack vector would likely be an attacker who can supply a crafted SCXML document to an application that loads it, such as via file upload, configuration, or network message. Because the vulnerability permits arbitrary code execution, the impact can be system‑wide if the hosting process runs with elevated privileges.