CVE-2026-120338— Prefab UI Pyodide sandbox escape to host RCE

Quick assessment

Affected

PrefectHQ prefab-ui

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Prefab UI 的生成式 UI（Generative UI）沙箱在 Deno 子进程中，通过 Pyodide（编译为 WebAssembly 的 Python）运行由调用方提供的 Python 代码。该功能被文档描述为用于隔离不可信代码（包括由大语言模型生成的 UI）。然而，在 prefab-ui 0.14.0 至 0.20.2 版本中，启动器以无限制的、和参数启动 Deno，且运行器将 Deno API 保留在 JavaScript 全局对象中。由于 Pyodide 的模块代理了该全局对象，Pytho

CVSS 9.9 · Critical Updated Nov 01, 2026

Possible ATT&CK Techniques 3 AI

T1547.001 · Registry Run Keys / Startup Folder T1059.001 · PowerShell T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Prefab UI Pyodide sandbox escape to host RCE

Source: CVE Program / CVE List V5

Vulnerability Description

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

保护机制失效

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
PrefectHQ	prefab-ui	0.14.0 ~ 0.21.0	-

II. Public POCs for CVE-2026-120338

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120338

请登录查看更多情报信息。

Other References for CVE-2026-120338 (9)

https://github.com/PrefectHQ/prefab/releases/tag/v0.21.0 release-notes
https://pypi.org/project/prefab-ui/0.21.0/ release-notes
https://pypi.org/project/prefab-ui/ product
https://github.com/PrefectHQ/prefab product
https://github.com/PrefectHQ/prefab/commit/030f074f85e0b1be0dd44b0283185aecb26337a2 patch
https://github.com/PrefectHQ/prefab/security/advisories/GHSA-595q-jv4r-q7j9 vendor-advisory
https://github.com/PrefectHQ/prefab/releases/tag/v0.20.2 technical-description
https://github.com/PrefectHQ/prefab/releases/tag/v0.14.0 technical-description
https://github.com/PrefectHQ/prefab/pull/538 patch

https://www.cve.org/CVERecord?id=CVE-2026-120338

IV. Related Vulnerabilities

Same vendor: PrefectHQ

Same weakness: CWE-693