CVE-2026-5463: pymetasploit3 RCE Vulnerability

CVE-2026-5463 Overview

A critical command injection vulnerability exists in the console.run_module_with_output() function within pymetasploit3 through version 1.0.6. This vulnerability allows attackers to inject newline characters into module options such as RHOSTS, breaking the intended command structure and causing the Metasploit console to execute additional unintended commands. Successful exploitation can lead to arbitrary command execution and manipulation of Metasploit sessions.

Critical Impact

Attackers can achieve arbitrary command execution by injecting newline characters into module options, potentially compromising Metasploit sessions and the underlying system.

Affected Products

• pymetasploit3 versions through 1.0.6
• Applications using the pymetasploit3 library for Metasploit Framework automation
• Systems running Metasploit Framework with vulnerable pymetasploit3 integrations

Discovery Timeline

• 2026-04-03 - CVE-2026-5463 published to NVD
• 2026-04-03 - Last updated in NVD database

Technical Details for CVE-2026-5463

Vulnerability Analysis

This command injection vulnerability (CWE-77) affects the pymetasploit3 Python library, which provides a Python interface for interacting with the Metasploit Framework's RPC API. The vulnerability resides in the console.run_module_with_output() function, which fails to properly sanitize user-controlled input before passing it to the Metasploit console for execution.

When module options like RHOSTS are processed, the function does not adequately filter or escape newline characters (\n). This allows an attacker to inject these characters into option values, effectively breaking out of the intended command context and injecting additional Metasploit console commands.

The impact is significant as it allows attackers to execute arbitrary Metasploit commands within an active session. This could lead to unauthorized access to target systems, manipulation of ongoing penetration testing sessions, data exfiltration, or pivoting to other network resources accessible through the Metasploit framework.

Root Cause

The root cause is improper input validation (CWE-77: Improper Neutralization of Special Elements used in a Command). The console.run_module_with_output() function does not sanitize or validate input parameters for special characters, particularly newline characters, before constructing and executing commands on the Metasploit console.

The function accepts user-supplied values for module options and passes them directly to the underlying console without stripping or escaping control characters. When a newline character is included in an option value, it terminates the current command and allows subsequent characters to be interpreted as a new command.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker who can control input to the console.run_module_with_output() function can craft malicious payloads containing newline characters within module option values.

For example, if an application using pymetasploit3 accepts user input for the RHOSTS option without proper sanitization, an attacker could inject a value like 192.168.1.1\nset PAYLOAD windows/meterpreter/reverse_tcp\nrun to execute additional commands beyond the intended scope.

The vulnerability mechanism involves newline character injection that breaks command parsing boundaries. When the Metasploit console receives the crafted input, it interprets the newline as a command terminator and executes any subsequent text as a new command. For detailed technical information, refer to the pymetasploit3 GitHub repository.

Detection Methods for CVE-2026-5463

Indicators of Compromise

• Unusual or unexpected commands appearing in Metasploit console logs
• Module options containing newline characters (\n, %0a, or \r\n)
• Unexpected module executions or payload changes in Metasploit sessions
• Anomalous network traffic originating from Metasploit Framework instances

Detection Strategies

• Monitor pymetasploit3 API calls for input containing newline or carriage return characters
• Implement logging for all console.run_module_with_output() invocations with full parameter capture
• Use application-level input validation to detect and block control characters in module options
• Deploy runtime application self-protection (RASP) solutions to detect command injection attempts

Monitoring Recommendations

• Enable verbose logging on Metasploit Framework console sessions
• Monitor system processes spawned by Metasploit for unexpected child processes
• Implement alerting for Metasploit sessions executing commands outside expected parameters
• Review audit logs for applications integrating pymetasploit3 for anomalous input patterns

How to Mitigate CVE-2026-5463

Immediate Actions Required

• Audit all applications using pymetasploit3 version 1.0.6 or earlier for potential exposure
• Implement strict input validation for all user-controllable parameters passed to pymetasploit3 functions
• Strip or reject input containing newline characters (\n, \r) before passing to module options
• Isolate systems running vulnerable pymetasploit3 implementations from untrusted networks

Patch Information

No official patch has been confirmed at this time. Organizations should monitor the pymetasploit3 GitHub repository and the PyPI package page for security updates. Until a patch is available, apply the workarounds listed below.

Workarounds

• Implement application-level input sanitization to remove newline and carriage return characters from all module option values
• Use allowlists for acceptable characters in module options (alphanumeric, periods, and hyphens for IP addresses)
• Run pymetasploit3 integrations in isolated environments with restricted network access
• Consider temporarily disabling user-controllable input to Metasploit module options until patched

# Input sanitization example - strip newlines before passing to pymetasploit3
# In your application code, sanitize input before calling run_module_with_output()
# Replace newline and carriage return characters
sanitized_rhosts=$(echo "$user_input" | tr -d '\n\r')