AIKIDO-2026-612732

TL;DR

The SCXML IO layer resolves external src references on data and invoke elements while parsing a document, before any expression evaluation runs. In the default secure trusted=False mode, a loaded document can name an arbitrary local file in a file:// URI and the parser opens and reads it with no path confinement or allowlist. The file contents are stored in a datamodel variable that the same untrusted document can then exfiltrate, and pointing the reference at a pseudo-device such as /dev/zero can also exhaust memory. The fix rejects external source references in untrusted mode and confines them when they are explicitly allowed.