CVE-2026-5463
A command injection flaw in pymetasploit3 lets attackers insert newline characters into module options, causing the Metasploit console to execute unintended commands. This can lead to arbitrary command execution and manipulation of Metasploit sessions. The vulnerability is rated critical with a CVSS score of 9.3.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
pymetasploit3 version 1.0.6 and earlier, used by Metasploit users.
Real-world impact
An attacker could run arbitrary commands on the system running Metasploit, potentially hijacking sessions or executing malicious code.
Why this severity
The CVSS score is high because the flaw allows remote attackers to execute arbitrary commands without authentication, leading to full system compromise.
What to do about it
- 01Upgrade pymetasploit3 to a version newer than 1.0.6.
- 02Restart the Metasploit console.
NVD-referenced vendor advisory
Timeline
- Apr 3, 2026 · Apr 3, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 26, 2026 · 10d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.