The vulnerability in pymetasploit3 (CVE-2026-5463) arises from improper neutralization of special elements (CWE-77) in the console.run_module_with_output() method. Attackers can inject newline characters into module options like RHOSTS, breaking the command structure and causing the Metasploit console to execute additional, unintended commands. This can result in arbitrary command execution and unauthorized control over Metasploit sessions. The issue affects versions through 1.0.6 and has a CVSS 4.0 score of 9.3, indicating critical severity. No known exploits are reported in the wild, and no patch or remediation details have been provided.

Successful exploitation allows remote attackers to execute arbitrary commands within the Metasploit console environment without authentication or user interaction, potentially leading to full compromise of Metasploit sessions. This can undermine the integrity and security of penetration testing activities relying on pymetasploit3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions of pymetasploit3 in untrusted environments or restrict usage to trusted inputs only. Monitor vendor channels for updates regarding patches or mitigations.