CVE-2026-5463 pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()
Attackers can inject newlines into module options to execute arbitrary commands via the Metasploit console.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-5463?
CVE-2026-5463 is a critical command injection vulnerability in Dan McInerney pymetasploit3, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended commands, potentially leading to arbitrary command execution and manipulation of Metasploit sessions.
Weakness: CWE-77
Which versions are affected by CVE-2026-5463?
3 open source packages ship an affected version, including pymetasploit3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pymetasploit3 PyPI | All versions to 1.0.6 | None |
pymetasploit3 PyPI | All versions to 1.0.6 | None |
pymetasploit3 PyPI | All versions to 1.0.6 | None |
Products include Danmcinerney Pymetasploit3.
How do I fix CVE-2026-5463?
No fix has been published for CVE-2026-5463 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-5463 being exploited?
There is no known exploitation of CVE-2026-5463 in the wild and no public exploit code.
Sources
Also known as GHSA-qpc3-8vqg-8g6w, PYSEC-2026-500.