CVE-2026-47103 is a critical remote code execution vulnerability in the fgmacedo python-statemachine library. Versions 3.0.0 up to but not including 3.2.0 are affected. The vulnerability occurs because the SCXMLProcessor component evaluates expressions from <data expr="..."> attributes in SCXML documents using Python's built-in eval() function without any sandboxing or input validation. This allows an attacker to supply malicious SCXML documents that execute arbitrary code in the context of the hosting process, leading to full compromise of the application environment.

Successful exploitation enables remote attackers to execute arbitrary code on the host running the vulnerable python-statemachine library. This can lead to complete system compromise, data theft, or disruption of service. The vulnerability requires no privileges or user interaction and has a low attack complexity, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted SCXML documents or disable evaluation of expressions within <data expr="..."> attributes if possible. Monitor vendor channels for updates and apply patches promptly once released.