Python StateMachine 3.0.0 < 3.2.0 RCE via SCXML eval() Injection

An attacker supplies a malicious SCXML document containing a `<data>` element with a crafted `expr` attribute, such as `__import__('pathlib').Path('marker.txt').write_text('pwned')`. When the application calls `SCXMLProcessor.parse_scxml_file()` followed by `SCXMLProcessor.start()`, the expression string is passed unsanitized through the call chain to Python's built-in `eval()`, achieving arbitrary code execution in the context of the hosting process [ref_id=1].

The vulnerability resides in `SCXMLProcessor.parse_scxml_file()` which processes SCXML documents. The call chain `SCXMLProcessor.process_definition()` → `create_datamodel_action_callable()` → `_create_dataitem_callable()` → `_eval()` ends in Python's built-in `eval()` on attacker-controlled `<data expr="...">` attribute values without any sandboxing or restriction [ref_id=1].

The advisory does not include a published patch diff. The recommended remediation is to restrict or sandbox the evaluation of `<data expr="...">` attributes in SCXML documents, or to avoid passing untrusted SCXML content to `SCXMLProcessor` entirely [ref_id=1].

1. Install: `pip install python-statemachine==3.1.2` 2. Create an SCXML file containing: `<data id="x" expr="__import__('pathlib').Path('marker.txt').write_text('pwned')"/>` 3. Run: `SCXMLProcessor.parse_scxml_file(DATA_EXPR_CHART)` then `SCXMLProcessor.start()` 4. During `start()`, `<data expr>` reaches `_eval()`, which calls `eval()`. 5. Result: `data_marker_before_start: False`, `data_marker_after_start: True`, `success: True` [ref_id=1]