Python StateMachine: remote code execution

Python StateMachine

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted <data expr="..."> attributes evaluated unsafely.

Do this now

Upgrade Python StateMachine to 3.2.0 or later, or stop loading untrusted SCXML documents.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 21:17 UTC
Identifiers: CVE-2026-47103
CVSS: 9.8
Source: news
On the menu as: Python

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Python StateMachine: remote code execution
Severity: critical. Patch status: fix status unknown.
Affected: Python StateMachine
Ids: CVE-2026-47103

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted <data expr="..."> attributes evaluated unsafely.

## Steps
1. Search the repo, its CI and infra config for Python StateMachine. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted <data expr="..."> attributes evaluated unsafely.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-47103") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/fgmacedo/python-statemachine/releases/tag/v3.2.0 https://nvd.nist.gov/vuln/detail/CVE-2026-47103
https://pwned.coffee/i/python-statemachine-remote-code-execution-cve-2026-47103

Timeline

23 Oct 2026, 21:17 UTC
Proof-of-concept code for CVE-2026-47103 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee