GitHub Advisoryadvisory · PyPI

GHSA-qpc3-8vqg-8g6w pymetasploit3 vulnerable to command injection in console.run_module_with_output()

CRITICAL Published 2026-04-03 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-5463
Ecosystem
PyPI
Packages
pymetasploit3
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Weaknesses
CWE-77
Reviewed
2026-04-06

Affected packages

• PyPI pymetasploit3: <= 1.0.6 (no fix yet)

Description

Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended commands, potentially leading to arbitrary command execution and manipulation of Metasploit sessions.

Related

Alias · CVE (1)

  • CVE-2026-5463 Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References