CVE-2026-5463
Published: 03 April 2026
Summary
CVE-2026-5463 is a critical-severity Command Injection (CWE-77) vulnerability in Danmcinerney Pymetasploit3. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 22.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5463 is a command injection vulnerability, tracked under CWE-77, that affects the pymetasploit3 library through version 1.0.6. It resides in the console.run_module_with_output() function, where unfiltered newline characters can be supplied in module options such as RHOSTS. The flaw allows the Metasploit console to interpret injected content as separate commands rather than option values, carrying a CVSS 4.0 score of 9.3.
An unauthenticated remote attacker can supply crafted module options to a pymetasploit3 client or service that invokes the affected function. Successful exploitation results in execution of arbitrary commands within the Metasploit console and the ability to manipulate active sessions.
The two reference URLs point only to the upstream GitHub repository and PyPI package page; no vendor advisory or patch details are provided in the available references.
EPSS for the CVE rose from a low baseline to a peak of 0.0178 on 2026-04-09 shortly after disclosure before receding to the current value of 0.0034.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18601
Vulnerability details
Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended commands, potentially leading…
more
to arbitrary command execution and manipulation of Metasploit sessions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in pymetasploit3 client library enables arbitrary command execution in Metasploit console (T1059), achieved via exploitation of vulnerable client software (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted input (module options such as RHOSTS) to block newline/command-separator injection into console.run_module_with_output().
Mandates prompt installation of patches or updates for the vulnerable pymetasploit3 ≤1.0.6 library to eliminate the command-injection flaw.
Limits privileges of the process invoking the Metasploit console so that successful injection yields only minimal additional capability.