Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit

Rapid7 weekly Metasploit updates add multiple exploit and post-exploitation modules. Notably, a new module for Flowise AI’s CSV Agent (CVE-2026-41264) implements an unauthenticated RCE via a CSV upload that can contain arbitrary Python—root cause: insufficient sandboxing and incomplete disallowed-input filtering. Other additions include an Apache .htaccess persistence module that plants a mod_cgi .htaccess web shell, a Peyara Remote Mouse 1.0.1 unauthenticated RCE exploit module, an SMB-to-Meterpreter upgrade using PsExec techniques, and a loongarch64 Linux exec payload. The Flowise CSV Agentv