TI-2026-04784 CVE-2026-5463 · GHSA-qpc3-8vqg-8g6wpymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()Priority MEDIUM 50Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS.CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.02152 · Published 2026-04-03 · No fix listed CWE-77