p PatchFirst

CVE-2026-5463

CVE-2026-5463 · pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended commands, potentially leading to arbitrary command execution and manipulation of Metasploit sessions.

CVSS 9.3 · Critical · EPSS 2.2%

Published
Updated

Stack: python

Affected products and versions

  • pymetasploit3

    Versions
    • ≥ 0, ≤ 1.0.6: Affected (python)

    No fix published

  • pymetasploit3 PyPI

    Versions
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.4
    • 1.0.5
    • 1.0.6
    Affected ranges
    • ECOSYSTEM: ≤ 1.0.6

    No fix published

Original sources

Check your server →