GHSA-qpc3-8vqg-8g6w

Source

https://github.com/advisories/GHSA-qpc3-8vqg-8g6w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qpc3-8vqg-8g6w/GHSA-qpc3-8vqg-8g6w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qpc3-8vqg-8g6w

Aliases

CVE-2026-5463
PYSEC-2026-500

Published

2026-04-03T06:31:33Z

Modified

2026-06-29T12:26:44Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L CVSS Calculator

Summary

pymetasploit3 vulnerable to command injection in console.run_module_with_output()

Details

Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended commands, potentially leading to arbitrary command execution and manipulation of Metasploit sessions.

Database specific

{
    "cwe_ids":  [
        "CWE-77"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-06T23:07:57Z",
    "nvd_published_at":  "2026-04-03T05:16:24Z",
    "severity":  "CRITICAL"
}

References

Affected packages

PyPI / pymetasploit3

Package

Name: pymetasploit3; View open source insights on deps.dev
Purl: pkg:pypi/pymetasploit3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.0.6

Affected versions

1.*

1.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-qpc3-8vqg-8g6w/GHSA-qpc3-8vqg-8g6w.json"