Detect python-statemachine SCXML <data expr> Eval Injection (CVE-2026-47103) in Splunk
CVE-2026-47103 is a critical eval injection vulnerability (CWE-95) in python-statemachine versions >= 3.0.0 and < 3.2.0. When processing SCXML documents, the library evaluates expressions in <data expr=...> elements using Python's eval(), allowing an attacker who can supply or influence SCXML input to execute arbitrary Python code in the context of the application process. A public PoC is available and exploitation requires no authentication when SCXML is parsed from user-controlled input. CVSS score 9.8.
MITRE ATT&CK
SPL Detection Query
index=* sourcetype IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "linux_secure", "osquery:results", "auditd")
| eval cmd=coalesce(CommandLine, command, cmdline, process)
| eval parent=coalesce(ParentCommandLine, parent_cmdline, parent_process)
| where match(cmd, "(?i)(statemachine|scxml)") OR match(cmd, "(?i)(\.scxml)")
| eval suspicious_pattern=if(
match(cmd, "(?i)(subprocess\.\w+|os\.system|__import__|exec\s*\(|eval\s*\(|base64\.b64decode)"), 1, 0
)
| eval scxml_file=if(match(cmd, "(?i)\.scxml"), 1, 0)
| eval network_spawn=if(match(parent, "(?i)(statemachine|scxml)") AND sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=3, 1, 0)
| eval risk_score=case(
suspicious_pattern=1, 90,
scxml_file=1 AND match(cmd, "(?i)(statemachine|python)"), 70,
scxml_file=1, 50,
true(), 30
)
| where risk_score >= 50
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands values(host) as hosts by risk_score, suspicious_pattern
| sort -risk_score
| eval first_seen=strftime(first_seen, "%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen, "%Y-%m-%dT%H:%M:%SZ")SPL search for CVE-2026-47103 exploitation indicators across Sysmon, Linux audit, and osquery sources. Scores events by risk based on SCXML file involvement, statemachine library usage, and presence of dangerous Python built-ins in command lines.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Developers testing python-statemachine with SCXML workflows in local environments
- Automated test suites that execute Python statemachine scenarios as part of integration testing
- Data pipeline scripts that generate SCXML files programmatically for legitimate workflow definitions
- Security researchers running PoC in isolated lab environments
Other platforms for CVE-2026-47103
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic SCXML eval injection via python-statemachine
Expected signal: Process execution of python3 with statemachine and scxml in command line; file creation event for /tmp/cve_2026_47103_pwned by the python3 process; pip install of vulnerable package version
- Test 2SCXML eval injection with reverse shell payload
Expected signal: Python3 process spawning /bin/bash child process with -i flag; outbound TCP connection to 127.0.0.1:4444 (or attacker IP in real scenario) from the python3 process; subprocess.Popen call visible in process tree
- Test 3SCXML eval injection via web API endpoint (simulated)
Expected signal: Flask application process accepting HTTP POST with SCXML content-type; python3 process creating temp .scxml file; file creation event for /tmp/api_pwned; process-level evidence of __import__ string construction via chr() obfuscation
References (5)
- https://github.com/fgmacedo/python-statemachine/security/advisories/GHSA-v4jc-pm6r-3vj8
- https://nvd.nist.gov/vuln/detail/CVE-2026-47103
- https://github.com/fgmacedo/python-statemachine/releases/tag/v3.2.0
- https://www.vulncheck.com/advisories/python-statemachine-rce-via-scxml-eval-injection
- https://github.com/advisories/GHSA-v4jc-pm6r-3vj8
Unlock Pro Content
Get the full detection package for CVE-2026-47103 including response playbook, investigation guide, and atomic red team tests.