Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit
2026-07-12T19:23:44Z•164e8ca78e4587de6bb2f9ce92a117b13f900a06f05953022138e45d1c4a1b56
AI-attack-surfaceCSV agentCVE-2026-41264FlowiseMeterpreterPeyaraPsExecRCESMBapacheexploithtaccessmetasploitpersistenceremote code executionunauthenticatedvulnerability-research
What happened
Rapid7 Metasploit weekly update: new exploit and post modules added. Notable additions include an exploit for Flowise CSV Agent Prompt Injection RCE (CVE-2026-41264) that permits unauthenticated attackers to upload a .csv containing arbitrary Python and achieve remote code execution due to insufficient sandboxing; a Linux Apache .htaccess persistence module planting a mod_cgi .htaccess web shell; an unauthenticated RCE module for Peyara Remote Mouse 1.0.1; and a post module to upgrade SMB sessions to Meterpreter via PsExec. The posts also discuss broader themes: AI expanding the attack surface
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 164e8ca78e4587de6bb2f9ce92a117b13f900a06f05953022138e45d1c4a1b56
- Enrichment time
- 2026-07-12T19:23:44Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.