High severity8.6NVD Advisory· Published Apr 3, 2026· Updated Jun 2, 2026
CVE-2026-5463
CVE-2026-5463
Description
Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended commands, potentially leading to arbitrary command execution and manipulation of Metasploit sessions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
pymetasploit3PyPI | <= 1.0.6 | — |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-qpc3-8vqg-8g6wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-5463ghsaADVISORY
- pypi.org/project/pymetasploit3ghsaWEB
- pypi.org/project/pymetasploit3/nvdProduct
News mentions
0No linked articles in our index yet.