This vulnerability (CVE-2026-5463) in Dan McInerney's pymetasploit3 library arises from improper neutralization of special elements (CWE-77) in the console.run_module_with_output() function. Attackers can inject newline characters into module options such as RHOSTS, breaking the intended command syntax and causing the Metasploit console to execute additional unintended commands. This results in potential arbitrary command execution and unauthorized manipulation of Metasploit sessions. The issue affects versions through 1.0.6 and has a CVSS 4.0 score of 9.3, indicating critical severity.

Successful exploitation can lead to arbitrary command execution within the Metasploit console environment, allowing attackers to manipulate Metasploit sessions beyond intended control. This could compromise the integrity and security of the system running pymetasploit3 and potentially affect any connected infrastructure managed through Metasploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid passing untrusted input to the console.run_module_with_output() function, especially in module options like RHOSTS, to prevent injection of newline characters. Monitor official channels for updates or patches from the pymetasploit3 maintainer.