CVE-2026-5463 is a high severity command injection flaw (CVSS 8.6) in pymetasploit3 through version 1.0.6. Newline characters in module options such as RHOSTS can break the command structure, so the Metasploit console runs extra commands. The record names no fixed version, so check the project before you rely on it.
What's affected
- pymetasploit3 through 1.0.6, per the record.
- Fixed version: not confirmed. The project page and the PyPI page were the references, and neither was a dated advisory with a patched release.
- The weak function is console.run_module_with_output().
How to check if you're exposed
Look for the library in your tooling.
pip show pymetasploit3
grep -ri pymetasploit3 requirements*.txt pyproject.toml
Then search your scripts for calls to run_module_with_output. Pay attention to scripts that pass option values taken from a web form, a ticket, a scan result or any other source you do not control.
What to do now
- Find every script and service that imports pymetasploit3.
- Check the project repository and PyPI for a release newer than 1.0.6 that addresses the issue.
- Until a fix is confirmed, validate option values before passing them in, and reject any that contain line breaks or control characters.
- Do not expose automation that drives Metasploit to untrusted users or networks.
Why it matters
The class is CWE-77, command injection. The library builds console input from option values, and the console treats a newline as the end of a command. An option that contains one can start another command.
The pattern is common in wrappers around command line tools. Any layer that joins strings into a command line must reject or encode control characters. The record does not mark the CVE as exploited in the wild. The tool in question is itself a security testing framework, so protect the hosts that run it.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Is a fixed release available?
The record does not say. Check the project repository and PyPI, and filter input in your own code in the meantime.
Sources
Last reviewed: 19 October 2026.
