Weekly Metasploit Update Exploits for FlowiseAI CSV Agent an...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rapid7.com/blog/post/pt-weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit
• Blog Title: Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and macOS PackageKit
• Suggested Section: HackTricks Main: AI Security / AI Models RCE for Flowise CSV Agent RCE; macOS Privilege Escalation for PackageKit ZSH .zshenv LPE; Linux Post-Exploitation or Apache Pentesting for .htaccess mod_cgi persistence

🎯 Content Summary

Rapid7’s weekly Metasploit update covers three new exploit/persistence modules, five framework enhancements, and two bug fixes. The most security-relevant additions are a FlowiseAI CSV Agent remote code execution exploit, a macOS PackageKit local privilege escalation module, and a Linux Apache .htaccess-based persistence module.

1. Flowise CSV Agent Prompt Injection RCE — CVE-2026-41264

Target: FlowiseAI Flowise, an open-source visual drag-and-drop platform f...

🔧 Technical Details

LLM-generated code execution through CSV-agent prompt injection: AI/LLM applications that generate and execute Python code from user-controlled CSV inputs create a high-risk execution boundary. If the application only uses an incomplete denylist and does not strongly sandbox the generated code, an attacker can place prompt-injection content or code-like instructions in the uploaded CSV so the LLM emits attacker-controlled Python. When the backend evaluates that Python, the payload executes as the server user. In Flowise CVE-2026-41264, this occurs in the run method of the CSV_Agents class. The Metasploit module multi/http/flowise_auth_rce_cve_2026_41264 automates exploitation against Flowise versions 1.3.0 through 3.0.13. The module needs an API key with chatflows:create permission to create the malicious flow, but the underlying flaw does not require Flowise authentication to trigger.

ZSH ...

🤖 Agent Actions

Done: updated src/AI/AI-Prompts.md.

Why this file:

• macos-privilege-escalation.md already documents the PackageKit ~/.zshenv privesc.
• Apache/CGI pages already cover .htaccess, ExecCGI, and related primitives.
• The new, non-duplicated value was the AI-specific technique: LLM-generated Python execution over attacker-controlled CSV/document content.

What I added:

• A concise new subsection on LLM-generated code over untrusted data sources (CSV / document analyzers).
• Exploit chain, pentest checks, and technical defenses.
• The Rapid7 blog link in the file’s ## References section.

Modified file:

• src/AI/AI-Prompts.md

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rapid7.com/blog/post/pt-weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit

Content Categories: Based on the analysis, this content was categorized under "HackTricks Main: AI Security / AI Models RCE for Flowise CSV Agent RCE; macOS Privilege Escalation for PackageKit ZSH .zshenv LPE; Linux Post-Exploitation or Apache Pentesting for .htaccess mod_cgi persistence".

Repository Maintenance:

• MD Files Formatting: 981 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0