The Pulse
Prefab UI Fixes Critical Sandbox Escape in Version 0.21.0
A flaw in Prefab UI’s Generative UI sandbox let submitted Python code access files as the server’s operating-system user. The vulnerability record identifies version 0.21.0 as fixed, while the project’s release page dates that version to Oc
AI.info Team · Written with AI · fact-checked ·
Prefab UI’s sandbox exposed the host
Prefab UI’s Generative UI feature was designed to isolate untrusted code, including interfaces written by large language models. But a flaw published in the GitHub Advisory Database on November 1 let supplied Python code reach the server’s file system through the runtime meant to contain it. The database record rates the vulnerability, CVE-2026-120338, critical with a CVSS score of 10.0.
The issue affected prefab-ui versions 0.14.0 through 0.20.2. The GitHub Advisory Database record says the feature requires Generative UI to be enabled and Deno installed; the remote exposure path commonly runs through FastMCP’s generate_prefab_ui tool. On a server without authentication, any client able to reach that tool could submit code. On an authenticated server, the risk applies to clients permitted to call tools.
Pyodide could reach Deno’s file APIs
The sandbox runs Python through Pyodide, a Python runtime compiled to WebAssembly, inside a Deno subprocess. In affected versions, Deno started with unrestricted read, write and network permissions, while its APIs remained available on the JavaScript global object. The database record says Pyodide’s JavaScript bridge could expose that global to the submitted Python code.
That route allowed code to read and write files with the permissions of the server’s operating-system user. The record also describes a way to persist execution by placing a .pth file in the server virtual environment’s site-packages directory. The CVSS vector lists a network attack, low complexity, no required privileges or user interaction, and high impacts to confidentiality, integrity and availability.
Fix merged before the record appeared
PrefectHQ’s pull request #538, merged October 25, included the sandbox change days before the vulnerability appeared in the GitHub Advisory Database. The patch revokes Deno’s read, write and network permissions after runtime setup and before accepting generated code, blocks permission prompts from restoring them, and limits bootstrap network access to jsDelivr. PrefectHQ released version 0.21.0 on October 26.
“Sandbox responses are correlated to requests, and bootstrap filesystem/network permissions are revoked before generated code executes.”
jlowin, pull-request author
That timeline matters for operators: the database record appeared after a patch was already present in the release, rather than preceding the fix. The advisory identifies 0.21.0 as fixed, but does not establish whether subsequent versions are also safe. Teams that do not use Generative UI are outside the record’s stated conditions; for affected deployments, the specific risk depends on whether an attacker can submit code through the tool.
The boundary depends on runtime permissions
The flaw was not that Pyodide failed to compile Python into WebAssembly. The database record points instead to the permissions around the runtime and the JavaScript APIs left available inside it: the sandbox process had host file and network access, and caller-supplied code could reach those capabilities.
Prefab UI’s fix changes that boundary by removing the permissions before untrusted code runs. Version 0.21.0, released October 26, is the patched release identified by the GitHub Advisory Database; the record was published November 1.