AIKIDO-2026-419538
python-statemachine is vulnerable to Uncontrolled Resource Consumption
75
High Risk
This Affects:
python-statemachineTL;DR
The restricted AST allowlist in the SCXML/native IO evaluator permits arithmetic operators such as ** and * with no bound on operand magnitude or result size. A tiny expression in an untrusted document, for example 9**9**9 or [0]*20000000, is compiled at load time and evaluated eagerly when the machine is instantiated. This lets a document processed in the default secure mode pin a CPU core or allocate gigabytes of memory, wedging or crashing the process even though document evaluation is advertised as safe. The fix caps operand magnitude in the restricted evaluator to prevent uncontrolled resource consumption.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you load SCXML documents from an untrusted source through the statemachine.io layer.
Background info
python-statemachine is vulnerable to Uncontrolled Resource Consumption in versions 3.2.0 - 3.2.0.
How to fix this
Upgrade the python-statemachine library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant