Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit
2026-07-12T07:23:42Z•5059e510ee5064410f24a0bdef3d0129c26adc6b6a47fd1ae7433059e4a6872d
AI riskApache .htaccess persistenceCSV AgentCVE-2026-41264FlowiseMacOS PackageKitMetasploitPeyara Remote MousePsExecSMB to Meterpreterexploit modulemulti-agent AIprompt injectionred teamingsandboxingunauthenticated RCEvulnerability managementzdi-disclosures
What happened
Rapid7 blog roundup: Metasploit added multiple new exploit and post modules, notably an unauthenticated remote code execution against Flowise CSV_Agents (CVE-2026-41264) that lets attackers upload a CSV containing arbitrary Python to achieve RCE due to insufficient sandboxing and incomplete input filtering. Other additions include an Apache .htaccess persistence module, an unauthenticated Peyara Remote Mouse 1.0.1 RCE exploit, and an SMB-to-Meterpreter upgrade via PsExec. The site also discusses broader topics: AI-driven risk in vulnerability discovery, red-team multi-agent AI architectures, S
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 5059e510ee5064410f24a0bdef3d0129c26adc6b6a47fd1ae7433059e4a6872d
- Enrichment time
- 2026-07-12T07:23:42Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.