AIKIDO-2026-570897
python-statemachine is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes
91
Critical Risk
This Affects:
python-statemachineTL;DR
The assign executable-content handler in the SCXML IO layer walks dotted attribute paths on the write side without rejecting underscore or dunder segments, unlike the guarded read side. An untrusted document in the default secure mode can traverse __class__ and overwrite pre-existing attributes on the shared Model class object. Because that class is shared across the process, corrupting it breaks all current and future state-machine instances, including unrelated trusted sessions, causing an integrity violation and a process-wide denial of service. The fix applies the same dunder rejection to write-target traversal so writes stay confined to public attributes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you load SCXML documents from an untrusted source through the statemachine.io layer.
Background info
python-statemachine is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in versions 3.2.0 - 3.2.0.
How to fix this
Upgrade the python-statemachine library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant