CVE-2026-120338
Received Received - Intake

Code Execution in Prefab UI Generative Sandbox

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: JFrog

Description
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120338

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PrefectHQ prefab-ui 0.14.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Prefab UI's Generative UI sandbox, which runs caller-supplied Python code inside Pyodide (Python compiled to WebAssembly) within a Deno subprocess. From versions 0.14.0 to 0.20.2, the sandbox granted unrestricted file read, write, and network access to the Python code. This allowed attackers to execute arbitrary code, read/write files as the server OS user, and persist code execution by modifying the server's virtual environment. The issue stems from improper permission revocation and exposure of the Deno API to Python.

The vulnerability is triggered when a client supplies malicious Python code to the sandbox via the generate_prefab_ui tool in FastMCP's GenerativeUI provider. Without authentication, any client can exploit this. Even with authentication, authorized clients can misuse the tool. The sandbox is opt-in and requires Deno to be installed on the server.

Detection Guidance

Check if your prefab-ui version is between 0.14.0 and 0.20.2. Inspect FastMCP server configurations for GenerativeUI provider usage. Verify if Deno is installed and if the sandbox feature is enabled. Look for unauthorized file reads/writes in server logs or filesystem activity.

Impact Analysis

If you run a FastMCP server with Prefab UI versions 0.14.0 to 0.20.2 and no authentication, any client with network access can exploit this to read sensitive files, write malicious files, or execute arbitrary code on your server. Even with authentication, authorized clients can perform these actions. This could lead to data breaches, system compromise, or persistent backdoors in your environment.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access and potential data exfiltration. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguards for protected health information. Exploitation could result in unauthorized access to sensitive data, leading to regulatory penalties, legal liabilities, and reputational damage.

Mitigation Strategies

Upgrade prefab-ui to version 0.21.0 or later. Disable the Generative UI feature if not required. Restrict network access to FastMCP servers. Review and revoke unnecessary permissions for Deno subprocesses. Monitor for suspicious file operations in the server environment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120338. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...