Weekly Metasploit Update: Exploits for FlowiseAI CSV Agent and MacOS Package Kit

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Betroffene Kennungen: CVE-2024-27822, CVE-2026-41264. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

More AI, more software, more bugs!AI, it's all you hear about nowadays and everyone's got an opinion on it. Here at Metasploit, we care less about those opinions and more about the growing attack surface all this new software brings with it (yeehaw exploits!). Take for example the new Flowise CSV Agent Prompt Injection RCE brought to you by Takahiro Yokoyama and zdi-disclosures. Flowise is an open-source tool that lets you build AI apps and chatbots using a visual, drag-and-drop canvas and CVE-2026-41264 is an unauthenticated RCE run method of the CSV_Agents class in Flowise. The vulnerability exists due insufficient sandboxing and an incomplete list of disallowed inputs. It allows unauthenticated attackers to upload a .csv file containing arbitrary python code and execute it. One moment you're using AI to help draft and email and the next moment you're getting pwn'd, what a world we live in! Happy Friday and happy hacking everyone.New module content (3)Apache .htaccess PersistenceAuthors: 4ravind-b, msutovsky-r7, and wireghoulType: ExploitPull request: #21473 contributed by 4ravind-bPath: linux/persistence/apache_htaccessDescription: Adds a new persistence module, exploits/linux/persistence/apache_htaccess, that plants wireghoul's mod_cgi .htaccess web shell on a Linux Apache target.Flowise CSV Agent Prompt Injection RCEAuthors: Takahiro Yokoyama and zdi-disclosuresType: ExploitPull request: #21407 contributed by Takahiro-YokoPath: multi/http/flowise_auth_rce_cve_2026_41264AttackerKB reference: CVE-2026-41264Description: This adds a new exploit module for FlowiseAI …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2024-27822, CVE-2026-41264): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.rapid7.com/blog/post/pt-weekly-metasploit-update-exploits-for-flowiseai-csv-agent-and-macos-package-kit
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.