Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120338updated 1 Nov 2026, 16:22 UTC

Prefab UI sandbox lets callers read and write server files

Prefab UI's Generative UI feature runs code meant to be isolated, but the isolation can be bypassed. Someone who can send code to it can read and change files on the server and keep running code there.

Fix available · out Official source
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesprefab-ui 0.21.0 (commit 030f074, pull request 538) · since 1 Nov 2026,
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends codeSends Python via generate_prefab_ui tool
  2. 2FastMCP serverForwards code argument into sandbox
  3. 3Pyodide sandboxPython reaches the Deno API via js module
  4. 4Server filesReads and writes files as OS user
  5. 5Persistent codeWrites .pth file into site-packages
  6. ResultAttacker runs code on the server

What happened

In prefab-ui 0.14.0 through 0.20.2, Python run in a Pyodide sandbox inside a Deno subprocess can call Deno file and write APIs because the launcher grants unrestricted read, write, and network permissions and leaves the Deno API exposed on the JavaScript global object. Attackers can write a .pth file into the server virtualenv's site-packages to persist code execution.

Why it is dangerous: An attacker can read secrets, change files, and run code as the server's OS user. This is most serious for FastMCP servers that expose the generate_prefab_ui tool.

Are you affected?

You are affected if you run prefab-ui 0.14.0 through 0.20.2 with Generative UI enabled and Deno installed, especially a FastMCP server that exposes the generate_prefab_ui tool.

prefab-ui 0.14.0 through 0.20.2 (confirmed on 0.20.2)

What to do

  1. Update prefab-ui to 0.21.0 or later.
  2. If you cannot update right away, disable Generative UI, since it is opt-in.
  3. Require authentication on your FastMCP server so only trusted clients can call generate_prefab_ui.
  4. Check the server virtualenv's site-packages for unexpected .pth files.

Timeline

  1. 1 Nov 2026, 16:18 UTC
    Publicly disclosed
  2. 1 Nov 2026, 16:18 UTC
    Reported by NVD · NVD
  3. 1 Nov 2026, 16:22 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120338
CVSS
10 / 10
Disclosed
1 Nov 2026, 16:18 UTC
On Zero Radar
1 Nov 2026, 16:22 UTC (4 min after disclosure)
Last change
1 Nov 2026, 16:22 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Prefab UI sandbox lets callers read and write server files · Zero Radar