CVE-2026-120338

Name of the Vulnerable Software and Affected Versions prefab-ui versions 0.14.0 through 0.20.2

Description The Generative UI sandbox runs caller-supplied Python code within Pyodide inside a Deno subprocess. The launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net permissions, and the runner leaves the Deno API on the JavaScript global object. Because Pyodide's js module proxies this global object, Python code can call Deno.readTextFileSync() and Deno.writeTextFileSync(). This allows an attacker to read and write files as the server OS user and achieve persistent code execution by writing a .pth file into the server virtualenv's site-packages. This issue is commonly reachable via FastMCP's GenerativeUI provider through the generate prefab ui tool, which forwards the code argument into the sandbox. On FastMCP servers without authentication, any client reaching the server can trigger this; otherwise, any client authorized to call tools can.

Recommendations Update to version 0.21.0.