CVE-2026-5463 - pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()

Back Back to CVE browser

CRITICAL

pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()

Published Apr 3, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 3.35%

Description

Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended commands, potentially leading to arbitrary command execution and manipulation of Metasploit sessions.

Affected products

Vendor Dan McInerney Product Pymetasploit3 Default
unaffected
Affected
- ≥ 0, ≤ 1.0.6

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Dan McInerney	Pymetasploit3	unaffected	Affected ≥ 0, ≤ 1.0.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-77

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18601
Advisory
https://github.com/DanMcInerney/pymetasploit3
third-party-advisoryProduct
https://github.com/advisories/GHSA-qpc3-8vqg-8g6w
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-5463
https://pypi.org/project/pymetasploit3
third-party-advisoryProduct

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18601		Advisory
https://github.com/DanMcInerney/pymetasploit3		third-party-advisoryProduct
https://github.com/advisories/GHSA-qpc3-8vqg-8g6w		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-5463
https://pypi.org/project/pymetasploit3		third-party-advisoryProduct