CVE-2026-5463CWE-77

pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()

Critical · published April 3, 2026

CVSS v4.0
9.3
EPSS
3%
Percentile
88.6
In the wild
Unconfirmed
What it is

Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended commands, potentially leading to arbitrary command execution and manipulation of Metasploit sessions.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L
EPSS
0.03351 · 88.6th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2026-04-03T04:32Z
EPSS history
Timeline
  • 03 APR 04:32Z
    Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into…
    cvelistv5