Reads were confined. Writes were not.

Release 3.2.0 introduced a declarative IO layer that loads SCXML, JSON and YAML statecharts with a restricted evaluator enabled by default through trusted=False.

Every path segment traversed during a restricted write must satisfy the same attribute policy as a restricted read, including intermediate objects and facade aliases.

The read side got this right. A representative rule blocks private and dunder reads outright:

case ast.Attribute(attr=attr) if allow_value_nodes:
    if attr.startswith("_"):
        raise ValueError(f"Attribute access to '{attr}' is not allowed")
    return build_attribute(recurse(node.value), attr)

That creates a clear expectation: an untrusted statechart may work with ordinary model fields, but must not walk into Python runtime internals such as classes, interpreters, engines or other shared implementation state.

The write path split the document-controlled location on dots and followed every intermediate element with raw getattr():

*path, attr = self.action.location.split(".")
obj = machine.model
for p in path:
    obj = getattr(obj, p)

if not attr.isidentifier() or not (hasattr(obj, attr) or attr in kwargs):
    raise ValueError(...)
if attr in protected_attrs:
    raise ValueError(...)
setattr(obj, attr, value)

Only the final attribute name is checked. The dangerous __class__ component is intermediate, so it reaches the shared class before the final-name checks ever execute.

A second public demonstration targets __class__.__name__. Changing the class name through one loaded machine is visible through other references to the same Model class — confirming the write crossed into process-shared state.

The destructive base trigger was not rerun merely for publication packaging.

Read policy and write policy were implemented separately. The evaluator enforced a strong rule for reading attribute paths, while <assign location> treated intermediate path components as ordinary Python traversal and protected only the final name.

That asymmetry is dangerous because a destination path is just as expressive as a read path. If an attacker can walk through a protected intermediate object during assignment, checking only the final field does not preserve the confinement model.

A sandboxed data model needs symmetric read and write confinement. Protecting sensitive objects from lookup is insufficient if destination traversal can still reach and mutate them.

A follow-on variant hardened under the same advisory family involved facade/system aliases offering another route into protected runtime objects. It is recorded as a distinct hardening case, not as a separate execution claim.

The demonstrated capability is unauthorized mutation of shared Python class and runtime state from a document that is supposed to be restricted. Concrete public outcomes:

1. changing shared class metadata, observable through unrelated references to the same class; and
2. replacing Model.__init__ with a non-callable data value, so subsequent model construction raises TypeError.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

No confidentiality impact is claimed for this advisory, and the write-side primitive should not be described as arbitrary code execution without separate evidence of attacker-controlled callable construction.

The public v3.2.0 and v3.2.1 tags and the corresponding PyPI source distributions were inspected, and the security-relevant source matched.

Upgrade to python-statemachine 3.2.1 or later.

Restricted write paths should validate every traversed segment before calling getattr() or setattr(). The same private/dunder restrictions used for reads should apply to destinations, aliases, wrappers and facade objects.

Regression coverage should include:

1. private/dunder names as the first segment;
2. private/dunder names in the middle of a path;
3. protected names as the final segment;
4. facade aliases that resolve to runtime objects;
5. allowed public nested writes, which must keep working;
6. assertions that failed assignments leave shared classes unchanged.

1. GHSA-v3qq-3xvg-m77g — python-statemachine advisory and public PoC
2. python-statemachine 3.2.1 security release notes
3. python-statemachine repository

Credit: The public advisory credits multiple reporters, including Charles Vosburgh. This page preserves that shared attribution and does not claim sole discovery. Research was AI-assisted through source mapping, hypothesis generation and release comparison; final validation and disclosure review remained human.