Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit

Rapid7's weekly Metasploit update introduces new exploit and post-exploitation modules, most notably an exploit for Flowise CSV Agent Prompt Injection RCE (CVE-2026-41264) that permits unauthenticated remote code execution by uploading a crafted .csv which can execute arbitrary Python due to insufficient sandboxing. Other additions include an Apache .htaccess persistence module, a Peyara Remote Mouse 1.0.1 unauthenticated RCE module, and tooling for SMB-to-Meterpreter upgrades via PsExec.