Prefab UI's Generative Sandbox Left Deno File and Network APIs Open to Model-Written Python

A critical sandbox escape in Prefab UI lets caller-supplied Python reach the host filesystem and network through Deno APIs that were never revoked after bootstrap—turning a documented isolation boundary into a remote code path on unauthenticated FastMCP servers. CVE-2026-120338 was published November 1, 2026 (modified November 3), assigned by JFrog as CNA, and scored CVSS 3.1 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Affected packages are prefab-ui 0.14.0 through 0.20.2. The fix shipped in 0.21.0.

Prefab’s Generative UI feature runs model- or caller-written Python inside Pyodide—Python compiled to WebAssembly—inside a Deno subprocess. The product documents that isolation as the safety story for untrusted UI code. On the vulnerable line, the launcher started Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner left the Deno API on the JavaScript global object. Pyodide’s js module proxies that global, so Python could call Deno.readTextFileSync and Deno.writeTextFileSync as the server OS user. Beyond one-shot file theft or overwrite, an attacker who can plant a .pth file in the server virtualenv’s site-packages gets persistent code execution on later Python starts. The issue was confirmed on 0.20.2.

How remote callers reach the sandbox

The common remote path is FastMCP’s GenerativeUI provider. It registers the MCP tool generate_prefab_ui and forwards that tool’s code argument into the same sandbox. On a FastMCP server with no authentication configured, any client that can reach the server can invoke the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed—so not every Prefab install is exposed—but the combination of “opt-in GenUI + Deno present + open MCP” is exactly the agent-tooling footprint many demo and internal servers use.

CWE tags on the OSV record include improper privilege management (CWE-269), protection mechanism failure (CWE-693), and code injection (CWE-94). Alias GHSA-595q-jv4r-q7j9 points at PrefectHQ/prefab’s security advisory track. References include the prefab-ui 0.21.0 PyPI release, GitHub release v0.21.0, commit 030f074, and pull request #538.

What 0.21.0 actually changes

Prefab released v0.21.0 on October 26, 2026 (PR #538 merged October 25). Per the vulnerability description, after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts generated code; the process starts with --no-prompt so a permission request cannot grant them again; and bootstrap network access is limited to cdn.jsdelivr.net. The pull request summary also notes that sandbox responses are correlated to requests and that bootstrap filesystem and network permissions are revoked before generated code executes—the security-relevant half of a broader dependency and renderer refresh.

Operators still on 0.14.0–0.20.2 should treat any Generative UI / generate_prefab_ui exposure as hostile until upgraded. Practical steps grounded in the advisory: upgrade to prefab-ui 0.21.0 or later (0.21.1 followed the same day for an unrelated docs-preview fix); disable GenerativeUI and the MCP tool for untrusted clients until the upgrade lands; and, if a vulnerable host ran with GenUI enabled, audit site-packages for unexpected .pth files and review Deno/process logs for unexpected reads and writes. There is no separate workaround listed beyond upgrading and restricting the feature.

Why agent UI sandboxes keep failing the same way

The failure mode is familiar in the 2026 agent stack: a runtime that needs broad permissions to bootstrap (fetch Pyodide, load Prefab sources) leaves those permissions attached when untrusted code runs. Proxying the host’s Deno global into Pyodide collapses the Wasm boundary. MCP tools that forward a free-form code argument amplify reach when the server is unauthenticated. Prefab’s fix—revoke after bootstrap, refuse interactive re-grants, pin bootstrap network—is the pattern other GenUI and code-act sandboxes will be measured against. Until hosts are on 0.21+, assume “isolated” Generative UI on Prefab is not.