The Metasploit Framework released two exploit modules on July 23 with distinct technical profiles: an unauthenticated RCE module for FlowiseAI, an open-source LLM flow orchestration platform, and a local privilege escalation module for macOS PackageKit. The more significant development is the operationalization of the AI attack surface: prompt injection becomes a remote code execution primitive, no longer a theoretical scenario.
- CVE-2026-41264 enables unauthenticated RCE in FlowiseAI 1.3.0-3.0.13 via prompt injection in the CSV Agent with Python code generation and execution
- The Flowise exploit requires an API key with the
chatflows:createpermission but bypasses the platform's native authentication - CVE-2024-27822 exploits ZSH environment inheritance in PackageKit to execute user-controlled code with root privileges during PKG installation
- Both modules are included in the weekly Metasploit update with PR #21407 for Flowise and technical references for the macOS module
From Prompt Injection to RCE: The FlowiseAI Mechanism
The vulnerability CVE-2026-41264 resides in the run method of the CSV_Agents class in Flowise. According to the official Metasploit blog, "CVE-2026-41264 is an unauthenticated RCE run method of the CSV_Agents class in Flowise." The attack vector unfolds in three stages: upload of a CSV file containing a malicious payload, prompt injection that induces the model to generate arbitrary Python code, and execution of that code on the server without effective sandboxing.
The module, contributed by Takahiro Yokoyama and zdi-disclosures via pull request #21407, exploits a combination of factors: "insufficient sandboxing and an incomplete list of disallowed inputs." The full technical description from the source details the mechanism: "The CSV Agent feature evaluates LLM-generated Python code without proper sandboxing, allowing a prompt injection to achieve arbitrary code execution as the user running the server." Affected versions are precisely identified: 1.3.0 through 3.0.13.
A relevant architectural element is the API key requirement. The module requires a key with the chatflows:create permission, but does not require Flowise authentication to trigger the flaw. This means a compromised key, even without valid user credentials, opens the RCE vector.
macOS PackageKit: When ZSH Inherits Root Privileges
The second module addresses CVE-2024-27822, a vulnerability in the macOS PackageKit framework. The mechanism differs: when a PKG installer script uses a ZSH shebang, PackageKit runs it as root while inheriting the environment of the user who initiated the installation. Per the source: "When a PKG installer script uses a ZSH shebang, PackageKit runs it as root while inheriting the installing user's environment, causing ZSH to source the user's ~/.zshenv with root privileges."
The module plants the payload in the user's ~/.zshenv file, configuring it to trigger only when the ZSH process runs as root. This ensures the malicious code does not execute during normal shell use, reducing detection risk, but activates precisely during the privileged moment of software installation.
The version scope is defined: macOS 14.4, 13.6.6, 12.7.4, and the 11 series and earlier are affected. Patches are available in releases 14.5, 13.6.7, and 12.7.5. The module does not exploit a zero-day: the flaw has been known since 2024, but its inclusion in Metasploit makes its use systematic and standardized.
"The CSV Agent feature evaluates LLM-generated Python code without proper sandboxing, allowing a prompt injection to achieve arbitrary code execution as the user running the server"
Why This Matters
The dossier does not specify whether in-the-wild exploits exist for either vulnerability. The source does not document specific mitigations beyond references to the macOS patches. It is unclear whether CVE-2026-41264 has already been published in the NVD or MITRE databases at the time of the module release. The numerical CVSS for the Flowise flaw is not reported in the technical brief, though it is qualitatively classified as RCE.
For the AI/ML sector, the Metasploit release marks a threshold: insufficient sandboxing in tools that generate and execute Python code from LLMs is no longer a conference-talk footnote but a standardized exploit primitive. The weaponization speed of prompt injection outpaces architectural defenses: incomplete sandboxing and incomplete disallowed-input lists prove inadequate against modules that automate the entire attack chain.
For macOS users, the risk persists on unpatched versions where installation of third-party software packages, even apparently legitimate ones, can trigger privilege escalation. Shell environment inheritance is a known but underestimated behavior in the design of privileged installation mechanisms.
Frequently Asked Questions
What is the technical difference between the two vulnerabilities?
CVE-2026-41264 is a logic flaw in the LLM-application interaction: lack of sandboxing in the parsing of generative output. CVE-2024-27822 is an isolation defect in the operating system: user environment inheritance in a privileged process. The first is application-layer and depends on the AI platform configuration; the second is system-layer and tied to PackageKit behavior on specific macOS versions.
Does the Flowise module require authenticated access?
No. The exploit does not require Flowise authentication to trigger the flaw, but it does need an API key with the chatflows:create permission. This creates an intermediate condition: it is not fully open access, but the barrier is reduced to a single service credential, potentially exposed or over-scoped.
Why does the dossier show a release date of 2026-07-11?
The brief lists 2026-07-11 as the event date, but this is in the future relative to the known temporal context. The dossier does not clarify whether this is a date error, predictive content, or a reference to a scheduled release calendar. The primary source is the Rapid7 Metasploit blog dated contextually to publication.
Sources
Information is based on the cited source and current as of publication.