{"slug": "weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit", "title": "Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit", "summary": "Rapid7's Metasploit Framework has added a new exploit for FlowiseAI Flowise (CVE-2026-41264), an unauthenticated remote code execution vulnerability in the CSV Agent feature that allows attackers to upload a .csv file containing arbitrary Python code. The update also includes a local privilege escalation exploit for macOS PackageKit (CVE-2024-27822) affecting macOS 14.4, 13.6.6, 12.7.4, and earlier, and a Linux Apache persistence module. The Flowise exploit targets versions 1.3.0 through 3.0.13 and requires an API key with chatflows:create permission but no authentication to trigger the flaw.", "body_md": "AI, it's all you hear about nowadays and everyone's got an opinion on it. Here at Metasploit, we care less about those opinions and more about the growing attack surface all this new software brings with it (yeehaw exploits!). Take for example the new Flowise CSV Agent Prompt Injection RCE brought to you by Takahiro Yokoyama and zdi-disclosures. Flowise is an open-source tool that lets you build AI apps and chatbots using a visual, drag-and-drop canvas and CVE-2026-41264 is an unauthenticated RCE run method of the CSV_Agents class in Flowise. The vulnerability exists due insufficient sandboxing and an incomplete list of disallowed inputs. It allows unauthenticated attackers to upload a .csv file containing arbitrary python code and execute it. One moment you're using AI to help draft and email and the next moment you're getting pwn'd, what a world we live in! Happy Friday and happy hacking everyone.\n\nAuthors: 4ravind-b, msutovsky-r7, and wireghoul\n\nType: Exploit\n\nPull request: [#21473](https://github.com/rapid7/metasploit-framework/pull/21473) contributed by [4ravind-b](https://github.com/4ravind-b)\n\nPath: linux/persistence/apache_htaccess\n\nDescription: Adds a new persistence module, exploits/linux/persistence/apache_htaccess, that plants wireghoul's mod_cgi .htaccess web shell on a Linux Apache target.\n\nAuthors: Takahiro Yokoyama and zdi-disclosures\n\nType: Exploit\n\nPull request: [#21407](https://github.com/rapid7/metasploit-framework/pull/21407) contributed by [Takahiro-Yoko](https://github.com/Takahiro-Yoko)\n\nPath: multi/http/flowise_auth_rce_cve_2026_41264\n\nAttackerKB reference: [CVE-2026-41264](https://attackerkb.com/search?q=CVE-2026-41264&referrer=blog)\n\nDescription: This adds a new exploit module for FlowiseAI Flowise (CVE-2026-41264). The CSV Agent feature evaluates LLM-generated Python code without proper sandboxing, allowing a prompt injection to achieve arbitrary code execution as the user running the server. Flowise versions 1.3.0 through 3.0.13 are affected. The module requires an API key with chatflows:create permission but does not require Flowise authentication to trigger the underlying flaw.\n\nAuthors: Mykola Grymalyuk and h00die\n\nType: Exploit\n\nPull request: [#21499](https://github.com/rapid7/metasploit-framework/pull/21499) contributed by [h00die](https://github.com/h00die)\n\nPath: osx/local/packagekit_zshenv_privesc\n\nAttackerKB reference: [CVE-2024-27822](https://attackerkb.com/search?q=CVE-2024-27822&referrer=blog)\n\nDescription: This adds a new local privilege escalation module for macOS targeting CVE-2024-27822 in PackageKit.framework. When a PKG installer script uses a ZSH shebang, PackageKit runs it as root while inheriting the installing user's environment, causing ZSH to source the user's ~/.zshenv with root privileges. The module plants a payload in ~/.zshenv that fires only when running as root, then opens a minimal PKG with Installer.app; once the user approves the installation prompt and authenticates, the payload executes as root and a root session is returned. Affected versions are macOS 14.4, 13.6.6, 12.7.4, and 11 and earlier; the issue is patched in 14.5, 13.6.7, and 12.7.5.\n\nYou can find the latest Metasploit documentation on our docsite at [docs.metasploit.com](https://docs.metasploit.com/).\n\nAs always, you can update to the latest Metasploit Framework with msfupdate and you can get more details on the changes since the last blog post from GitHub:\n\nIf you are a git user, you can clone the [Metasploit Framework repo](https://github.com/rapid7/metasploit-framework) (master branch) for the latest. To install fresh without using git, you can use the open-source-only [Nightly Installers](https://github.com/rapid7/metasploit-framework/wiki/Nightly-Installers) or the commercial edition [Metasploit Pro](https://www.rapid7.com/products/metasploit/download/)", "url": "https://wpnews.pro/news/weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit", "canonical_source": "https://www.rapid7.com/blog/post/pt-weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit", "published_at": "2026-07-11 00:32:34+00:00", "updated_at": "2026-07-23 03:07:51.249075+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-products", "ai-tools"], "entities": ["Rapid7", "Metasploit Framework", "FlowiseAI", "Takahiro Yokoyama", "ZDI", "CVE-2026-41264", "CVE-2024-27822", "PackageKit"], "alternates": {"html": "https://wpnews.pro/news/weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit", "markdown": "https://wpnews.pro/news/weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit.md", "text": "https://wpnews.pro/news/weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit.txt", "jsonld": "https://wpnews.pro/news/weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit.jsonld"}}