This vulnerability involves improper neutralization of directives in dynamically evaluated code (CWE-95) within the Rapid7 Insight Agent for Linux. Specifically, the agent's beaconing logic uses eval() in a way that could be manipulated via a crafted beacon response to execute arbitrary code with root privileges. The agent authenticates commands using mutual TLS, which significantly reduces the risk of remote exploitation without prior privileged access to the backend platform. The CVSS 3.1 base score is 6.6, reflecting medium severity with high impact on confidentiality, integrity, and availability, but requiring high attack complexity and privileges.

Successful exploitation could lead to remote code execution as root on affected Linux systems running the Rapid7 Insight Agent. This would compromise system confidentiality, integrity, and availability. However, the requirement for prior highly privileged access to the backend platform and the use of mTLS for command verification greatly limit the practical exploitability of this vulnerability.

No official patch or remediation is currently available or confirmed. Since the agent uses mutual TLS to verify commands, the vendor's security controls reduce the likelihood of remote exploitation. Organizations should monitor vendor advisories for updates and apply any future patches promptly. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.