The unserialize_object() method in lib/msf/core/db_manager/import/metasploit_framework.rb decodes base64 text from imported files and passes it directly to Marshal.load() with no class allow-list. Multiple call sites across the XML and ZIP importers feed attacker-controlled data into this path.
Because the data is deserialized without restriction, any available Ruby deserialization gadget chain can be used to escalate from deserialization to code execution. The chain reported against current supported environments ends in a guard bypass in Ruby's ERB standard library, tracked upstream as CVE-2026-41316. Earlier chains affected only unsupported Ruby versions, but the underlying weakness — calling Marshal.load() on untrusted input — is independent of any single chain.
Mitigation / recommended action
- Update to the 6.4.126 Metasploit Framework release or later.
- Do not import XML or ZIP files from untrusted sources into Metasploit.
References
TristanInSec Reporter
The
unserialize_object()method inlib/msf/core/db_manager/import/metasploit_framework.rbdecodes base64 text from imported files and passes it directly toMarshal.load()with no class allow-list. Multiple call sites across the XML and ZIP importers feed attacker-controlled data into this path.Because the data is deserialized without restriction, any available Ruby deserialization gadget chain can be used to escalate from deserialization to code execution. The chain reported against current supported environments ends in a guard bypass in Ruby's ERB standard library, tracked upstream as CVE-2026-41316. Earlier chains affected only unsupported Ruby versions, but the underlying weakness — calling
Marshal.load()on untrusted input — is independent of any single chain.Mitigation / recommended action
References