PT-2026-29988 · Unknown · Pymetasploit3

Abdivasiyev Sunnatillo · Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-5463

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pymetasploit3 versions through 1.0.6

Description A command injection issue exists in the console.run module with output() function of pymetasploit3. Attackers can inject newline characters into module options, such as the RHOSTS parameter, disrupting command parsing and potentially enabling arbitrary command execution and manipulation of Metasploit sessions.

Recommendations Update pymetasploit3 to a version later than 1.0.6.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-5463

GHSA-QPC3-8VQG-8G6W

Affected Products

Pymetasploit3

References · 9

• 🔥 https://github.com/DanMcInerney/pymetasploit3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5463 · Security Note
• https://osv.dev/vulnerability/GHSA-qpc3-8vqg-8g6w · Vendor Advisory
• https://twitter.com/CveFindCom/status/2039941665998139514 · Twitter Post
• https://pypi.org/project/pymetasploit3 · Note
• https://twitter.com/TheHackerWire/status/2039945929223258115 · Twitter Post
• https://twitter.com/0dayPublishing/status/2039937037290115295 · Twitter Post
• https://twitter.com/cyberbivash/status/2039967005298618703 · Twitter Post
• https://twitter.com/CVEnew/status/2040128726055215210 · Twitter Post