AIKIDO-2026-419538
python-statemachine is vulnerable to Uncontrolled Resource Consumption
75
CVE Score
High
Uncontrolled Resource Consumption
TL;DR
The restricted AST allowlist in the SCXML/native IO evaluator permits arithmetic operators such as ** and * with no bound on operand magnitude or result size. A tiny expression in an untrusted document, for example 9**9**9 or [0]*20000000, is compiled at load time and evaluated eagerly when the machine is instantiated. This lets a document processed in the default secure mode pin a CPU core or allocate gigabytes of memory, wedging or crashing the process even though document evaluation is advertised as safe. The fix caps operand magnitude in the restricted evaluator to prevent uncontrolled resource consumption.
How do I fix this?
Upgrade the python-statemachine library to the patch version.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you load SCXML documents from an untrusted source through the statemachine.io layer.
Package
Versions
3.2.0 - 3.2.0
Fixed in 3.2.1Background info
python-statemachine is vulnerable to Uncontrolled Resource Consumption in versions 3.2.0 - 3.2.0.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.