The sandbox arrived after the file was read.

The public loader API defaults to restricted mode, which sets a reasonable user expectation that an external document will not automatically receive process authority:

def load(
    source: "str | Path",
    *,
    format: "str | None" = None,
    trusted: bool = False,
    validate: bool = False,
    name: "str | None" = None,
) -> "type[StateChart]":

All external resource resolution requested by an untrusted statechart must be authorized before any file, network or URI handler performs I/O.

The problem was ordering. In 3.2.0, loader.py::_build() asked the format reader to parse the document first, and only afterwards created the interpreter with the trust-appropriate evaluator:

definition = reader.read(text, source_name=name or location_hint)

location = name or definition.name or location_hint or "statechart"
interpreter = Interpreter(reader=reader, evaluator=evaluator_for(trusted))
interpreter.process_definition(definition, location=location)

The sensitive read happened inside the SCXML reader during that first step. A document-controlled <data src> value was parsed as a URI; if the scheme was file and the element had no inline content, 3.2.0 opened the path immediately:

src = data_elem.attrib.get("src")
src_parsed = urlparse(src) if src else None
if src_parsed and src_parsed.scheme == "file" and content is None:
    with open(src_parsed.path) as f:
        content = f.read()

By the time RestrictedEvaluator existed, the file had already been read and its bytes had entered the statechart definition. The later action-building code turned that data item into a model value the document could reference or log through ordinary statechart expressions.

The maximum disclosure is bounded by the operating-system permissions of the Python process. The vulnerability does not bypass filesystem ACLs; it gives the untrusted statechart access to the process’s ambient read authority.

That fixed-version control is the key result: the corrected implementation makes the trust decision before I/O rather than filtering a value that has already been read.

The loader treated external source resolution as parser setup rather than as a privileged operation subject to the trust model. The restricted evaluator controlled expression evaluation but did not own the earlier file-open step, so policy was applied too late in the pipeline.

“Untrusted mode” must cover preprocessing as well as evaluation. If parsing can read files or fetch resources first, a later sandbox cannot undo the disclosure.

This is a general loader-design hazard: parsing, normalization, include resolution, schema imports, templates and external resources can all perform privileged work before the system reaches the component everyone thinks of as “the sandbox.”

The fixing commit is f7159a8549c5c26de0babb7b67c882804037a24e, released in 3.2.1. The corrected SCXML reader retains the external source reference instead of opening it during parsing, deferring resolution until the action layer can ask the active evaluator whether external sources are permitted:

evaluator.ensure_external_src_allowed(...)

The restricted evaluator raises an invalid-definition error; the trusted evaluator continues to support the documented feature. The same trust boundary was applied to related external-source surfaces such as <invoke src> and srcexpr, so the fix does not protect only one syntax form.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

A consuming application that accepts attacker-controlled SCXML can unintentionally expose local text files readable by its Python process — application configuration, credentials stored in readable files, source material or tokens, depending on deployment.

The prior 3.1.2 release does not contain the same public loader surface.

Upgrade to python-statemachine 3.2.1 or later. If an application intentionally needs external SCXML resources, use trusted mode only for documents from a source it is willing to grant that authority. For untrusted documents, keep external resolution disabled regardless of URI scheme.

Regression coverage should include:

1. file: references under restricted mode;
2. equivalent relative and absolute source forms;
3. trusted-mode positive controls;
4. <invoke src> and srcexpr;
5. assertions that the sensitive file is never opened when policy denies the source;
6. network URI handlers, if support is added in future.

1. GHSA-fj3w-533r-fvf6 — python-statemachine advisory and public PoC
2. python-statemachine 3.2.1 release
3. 3.2.1 security release notes

Credit: The public advisory credits Charles Vosburgh, Pig-Tail and manus-use as reporters. This page does not claim sole discovery. Research was AI-assisted through source mapping, hypothesis generation and release comparison; final validation and disclosure review remained human.