CVE-2026-120338: Prefab UI Generative UI Sandbox Escape Leads to Host RCE

CVE-2026-120338: Prefab UI Generative UI Sandbox Escape

A maximum-severity sandbox escape (CVSS 10.0) was published on November 1, 2026 in prefab-ui, the PrefectHQ library whose Generative UI feature runs caller-supplied Python inside Pyodide (Python compiled to WebAssembly) in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI, but the isolation does not hold in versions 0.14.0 through 0.20.2.

Vulnerability Overview

Technical Description

Two problems combine:

1. Deno API left on the global object. The runner leaves Deno on the JavaScript global. Pyodide's js module proxies that global, so sandboxed Python can call Deno.readTextFileSync and Deno.writeTextFileSync against the host filesystem.
2. Unrestricted launcher permissions. The launcher starts Deno with unrestricted --allow-read, --allow-write and --allow-net, so nothing at the Deno layer stops those calls.

An attacker who can supply code can read and write files as the server's OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages, which Python executes at interpreter startup.

Remote Reachability

FastMCP's GenerativeUI provider registers the MCP tool generate_prefab_ui and forwards its code argument into the sandbox. Without authentication, any client that can reach the server can call it. With authentication, any client permitted to call tools can.

Impact Assessment

Remediation Guidance

1. Upgrade prefab-ui to 0.21.0 or later. The fix revokes Deno read, write and network permissions after the runtime loads and before code is accepted, starts the process with --no-prompt, and limits bootstrap network access to cdn.jsdelivr.net.
2. Hunt for prior compromise. The patch does not undo earlier writes. Check site-packages in server virtualenvs for unexpected .pth files.
3. Rotate secrets reachable by the server user if the tool was exposed to untrusted callers.
4. Reduce exposure. If upgrading is not immediately possible, disable Generative UI or remove the generate_prefab_ui tool, and put MCP servers behind authentication and network controls.
5. Monitor for unexpected file writes by the server process and unusual generate_prefab_ui calls.

Key Takeaways

1. A CVSS 10.0 sandbox escape affects prefab-ui 0.14.0 through 0.20.2; 0.21.0 fixes it
2. Servers exposing generate_prefab_ui over MCP are remotely reachable by any permitted tool caller
3. Patching does not remove planted files, so check for .pth persistence
4. Treat "sandboxed" LLM-code execution as untrusted until permissions are enforced at the runtime layer

Sources

• CVE-2026-120338 — NIST NVD
• JFrog Security Research advisory