Technical impact
Python StateMachine 3.x processes SCXML documents that include <data expr="..."> attributes. In affected versions, the expression string is passed directly to Python's eval() without sanitization. This allows an attacker to embed arbitrary Python code in a malicious SCXML file, leading to remote code execution in the context of the hosting application. The weakness is an unsafe expression evaluation, mapped to CWE‑94 and CWE‑95.
Affected Systems
The vulnerability exists in the open-source Python library python‑statemachine maintained by fgmacedo. Users who are running versions 3.0.0 through 3.1.x are affected. Versions 3.2.0 and later mitigate the flaw.
Risk and Exploitability
The CVSS score of 9.3 indicates a critical vulnerability that allows arbitrary code execution within the hosting process. Based on the description, it is inferred that the attack vector would be an attacker who can supply a crafted SCXML document to an application that processes SCXML, such as via file upload, configuration, or network message. The EPSS score is about 1.17%, indicating a low current exploitation probability. The lack of a KEV listing suggests no publicly known exploit has been observed. Arbitrary code execution could compromise confidentiality, integrity, and availability in the context of the hosting process, especially if the process runs with elevated privileges.
Github GHSA