CVE-2026-47103 is a critical remote code execution vulnerability in the fgmacedo python-statemachine library, affecting versions 3.0.0 through before 3.2.0. The vulnerability stems from improper neutralization of directives in dynamically evaluated code, where malicious SCXML documents with crafted <data expr="..."> attributes are processed. The SCXMLProcessor passes these attacker-controlled expressions through a call chain that ends in Python's built-in eval() function without sandboxing or validation, enabling arbitrary code execution in the context of the hosting process.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely within the context of the affected application process. This can lead to full system compromise, data theft, or disruption of service. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted SCXML documents or disable features that evaluate expressions from external input. Monitor vendor channels for updates and apply patches promptly once released.